Task: attack_reconstruction (flaws_cloudtrail)
Prompt: One principal appears to gain a foothold and then conduct a broad AWS inventory sweep spanning IAM, EC2/VPC, S3, Lambda, and RDS. Identify the responsible principal, the MITRE ATT&CK technique that best describes the behavior, the supporting CloudTrail record_ids grouped by each phase of the chain, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48be6248-d536-4bfb-8f0d-14acd1f45cdf", "record_id": "flaws_cloudtrail:0000000:48be6248-d536-4bfb-8f0d-14acd1f45cdf", "row_index": 0, "timestamp": "2019-03-25T19:58:13Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48be6248-d536-4bfb-8f0d-14acd1f45cdf", "eventTime": "2019-03-25T19:58:13Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4c1e11bd246faf42c", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "150f5021-287d-4e65-9e5c-adf9891910c0", "record_id": "flaws_cloudtrail:0000001:150f5021-287d-4e65-9e5c-adf9891910c0", "row_index": 1, "timestamp": "2019-03-25T19:58:14Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "150f5021-287d-4e65-9e5c-adf9891910c0", "eventTime": "2019-03-25T19:58:14Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-5e0259b13eba4c023", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ec11140-c91e-4b99-b1f8-54e1e9fe51b6", "record_id": "flaws_cloudtrail:0000002:7ec11140-c91e-4b99-b1f8-54e1e9fe51b6", "row_index": 2, "timestamp": "2019-03-25T19:58:14Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ec11140-c91e-4b99-b1f8-54e1e9fe51b6", "eventTime": "2019-03-25T19:58:14Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-86ab8b76bbb9bf3a2", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "150f5021-287d-4e65-9e5c-adf9891910c0", "record_id": "flaws_cloudtrail:0000003:150f5021-287d-4e65-9e5c-adf9891910c0", "row_index": 3, "timestamp": "2019-03-25T19:58:14Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "150f5021-287d-4e65-9e5c-adf9891910c0", "eventTime": "2019-03-25T19:58:14Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-5e0259b13eba4c023", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ec11140-c91e-4b99-b1f8-54e1e9fe51b6", "record_id": "flaws_cloudtrail:0000004:7ec11140-c91e-4b99-b1f8-54e1e9fe51b6", "row_index": 4, "timestamp": "2019-03-25T19:58:14Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ec11140-c91e-4b99-b1f8-54e1e9fe51b6", "eventTime": "2019-03-25T19:58:14Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-86ab8b76bbb9bf3a2", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d582b856-2308-4ccd-b4f5-07cea45ad113", "record_id": "flaws_cloudtrail:0000005:d582b856-2308-4ccd-b4f5-07cea45ad113", "row_index": 5, "timestamp": "2019-03-25T19:58:15Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d582b856-2308-4ccd-b4f5-07cea45ad113", "eventTime": "2019-03-25T19:58:15Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-33e2f0209e4f6abb7", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d582b856-2308-4ccd-b4f5-07cea45ad113", "record_id": "flaws_cloudtrail:0000006:d582b856-2308-4ccd-b4f5-07cea45ad113", "row_index": 6, "timestamp": "2019-03-25T19:58:15Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d582b856-2308-4ccd-b4f5-07cea45ad113", "eventTime": "2019-03-25T19:58:15Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-33e2f0209e4f6abb7", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19f943e0-12b4-4ad2-b9a5-679e83d80750", "record_id": "flaws_cloudtrail:0000007:19f943e0-12b4-4ad2-b9a5-679e83d80750", "row_index": 7, "timestamp": "2019-03-25T19:58:16Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19f943e0-12b4-4ad2-b9a5-679e83d80750", "eventTime": "2019-03-25T19:58:16Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-6de7cb4c417eb3b1d", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10dfbcad-2693-46ec-9afa-356d925de14e", "record_id": "flaws_cloudtrail:0000008:10dfbcad-2693-46ec-9afa-356d925de14e", "row_index": 8, "timestamp": "2019-03-25T19:58:16Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10dfbcad-2693-46ec-9afa-356d925de14e", "eventTime": "2019-03-25T19:58:16Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-77faf57c5b286da86", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19f943e0-12b4-4ad2-b9a5-679e83d80750", "record_id": "flaws_cloudtrail:0000009:19f943e0-12b4-4ad2-b9a5-679e83d80750", "row_index": 9, "timestamp": "2019-03-25T19:58:16Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19f943e0-12b4-4ad2-b9a5-679e83d80750", "eventTime": "2019-03-25T19:58:16Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-6de7cb4c417eb3b1d", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10dfbcad-2693-46ec-9afa-356d925de14e", "record_id": "flaws_cloudtrail:0000010:10dfbcad-2693-46ec-9afa-356d925de14e", "row_index": 10, "timestamp": "2019-03-25T19:58:16Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10dfbcad-2693-46ec-9afa-356d925de14e", "eventTime": "2019-03-25T19:58:16Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-77faf57c5b286da86", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a659606-af56-45ce-8547-c4d6ff21d028", "record_id": "flaws_cloudtrail:0000011:4a659606-af56-45ce-8547-c4d6ff21d028", "row_index": 11, "timestamp": "2019-03-25T19:58:17Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a659606-af56-45ce-8547-c4d6ff21d028", "eventTime": "2019-03-25T19:58:17Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-2687a7f0020c0165d", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a659606-af56-45ce-8547-c4d6ff21d028", "record_id": "flaws_cloudtrail:0000012:4a659606-af56-45ce-8547-c4d6ff21d028", "row_index": 12, "timestamp": "2019-03-25T19:58:17Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a659606-af56-45ce-8547-c4d6ff21d028", "eventTime": "2019-03-25T19:58:17Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-2687a7f0020c0165d", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb23d710-ae1c-40e2-898a-258235bbbe03", "record_id": "flaws_cloudtrail:0000013:eb23d710-ae1c-40e2-898a-258235bbbe03", "row_index": 13, "timestamp": "2019-03-25T19:58:21Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb23d710-ae1c-40e2-898a-258235bbbe03", "eventTime": "2019-03-25T19:58:21Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-c088c04a5a23327a3", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfc288d6-a297-4a61-94ec-5acbf401ce33", "record_id": "flaws_cloudtrail:0000014:cfc288d6-a297-4a61-94ec-5acbf401ce33", "row_index": 14, "timestamp": "2019-03-25T19:58:21Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfc288d6-a297-4a61-94ec-5acbf401ce33", "eventTime": "2019-03-25T19:58:21Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-8c7cb9926fc8464e9", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb23d710-ae1c-40e2-898a-258235bbbe03", "record_id": "flaws_cloudtrail:0000015:eb23d710-ae1c-40e2-898a-258235bbbe03", "row_index": 15, "timestamp": "2019-03-25T19:58:21Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb23d710-ae1c-40e2-898a-258235bbbe03", "eventTime": "2019-03-25T19:58:21Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-c088c04a5a23327a3", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfc288d6-a297-4a61-94ec-5acbf401ce33", "record_id": "flaws_cloudtrail:0000016:cfc288d6-a297-4a61-94ec-5acbf401ce33", "row_index": 16, "timestamp": "2019-03-25T19:58:21Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfc288d6-a297-4a61-94ec-5acbf401ce33", "eventTime": "2019-03-25T19:58:21Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-8c7cb9926fc8464e9", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65281e-4d48-4adb-bc73-77e7173ef4a6", "record_id": "flaws_cloudtrail:0000017:65281e-4d48-4adb-bc73-77e7173ef4a6", "row_index": 17, "timestamp": "2019-03-25T19:58:22Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65281e-4d48-4adb-bc73-77e7173ef4a6", "eventTime": "2019-03-25T19:58:22Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-9c57b3e6686cde148", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7fa492a-fffe-49a6-af2c-435a7e3a11e0", "record_id": "flaws_cloudtrail:0000018:d7fa492a-fffe-49a6-af2c-435a7e3a11e0", "row_index": 18, "timestamp": "2019-03-25T19:58:22Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7fa492a-fffe-49a6-af2c-435a7e3a11e0", "eventTime": "2019-03-25T19:58:22Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-6bd1a58fac2b6dbfb", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65281e-4d48-4adb-bc73-77e7173ef4a6", "record_id": "flaws_cloudtrail:0000019:65281e-4d48-4adb-bc73-77e7173ef4a6", "row_index": 19, "timestamp": "2019-03-25T19:58:22Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65281e-4d48-4adb-bc73-77e7173ef4a6", "eventTime": "2019-03-25T19:58:22Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-9c57b3e6686cde148", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7fa492a-fffe-49a6-af2c-435a7e3a11e0", "record_id": "flaws_cloudtrail:0000020:d7fa492a-fffe-49a6-af2c-435a7e3a11e0", "row_index": 20, "timestamp": "2019-03-25T19:58:22Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7fa492a-fffe-49a6-af2c-435a7e3a11e0", "eventTime": "2019-03-25T19:58:22Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-6bd1a58fac2b6dbfb", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd8db941-fe1f-4cd2-92b1-7a749238a8fb5", "record_id": "flaws_cloudtrail:0000021:dd8db941-fe1f-4cd2-92b1-7a749238a8fb5", "row_index": 21, "timestamp": "2019-03-25T19:58:23Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd8db941-fe1f-4cd2-92b1-7a749238a8fb5", "eventTime": "2019-03-25T19:58:23Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-6eaa3f0ec338d4988", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd8db941-fe1f-4cd2-92b1-7a749238a8fb5", "record_id": "flaws_cloudtrail:0000022:dd8db941-fe1f-4cd2-92b1-7a749238a8fb5", "row_index": 22, "timestamp": "2019-03-25T19:58:23Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd8db941-fe1f-4cd2-92b1-7a749238a8fb5", "eventTime": "2019-03-25T19:58:23Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-6eaa3f0ec338d4988", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12c4e7ff-8cc9-41e0-ac70-b37ad9b93713", "record_id": "flaws_cloudtrail:0000023:12c4e7ff-8cc9-41e0-ac70-b37ad9b93713", "row_index": 23, "timestamp": "2019-03-25T19:58:24Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12c4e7ff-8cc9-41e0-ac70-b37ad9b93713", "eventTime": "2019-03-25T19:58:24Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-598f67698f8d56766", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12c4e7ff-8cc9-41e0-ac70-b37ad9b93713", "record_id": "flaws_cloudtrail:0000024:12c4e7ff-8cc9-41e0-ac70-b37ad9b93713", "row_index": 24, "timestamp": "2019-03-25T19:58:24Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12c4e7ff-8cc9-41e0-ac70-b37ad9b93713", "eventTime": "2019-03-25T19:58:24Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-598f67698f8d56766", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "356518b-8101-4c15-b315-291c234274c5", "record_id": "flaws_cloudtrail:0000025:356518b-8101-4c15-b315-291c234274c5", "row_index": 25, "timestamp": "2019-03-25T20:03:33Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "356518b-8101-4c15-b315-291c234274c5", "eventTime": "2019-03-25T20:03:33Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "356518b-8101-4c15-b315-291c234274c5", "record_id": "flaws_cloudtrail:0000026:356518b-8101-4c15-b315-291c234274c5", "row_index": 26, "timestamp": "2019-03-25T20:03:33Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "356518b-8101-4c15-b315-291c234274c5", "eventTime": "2019-03-25T20:03:33Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16281c03-520b-46f5-8945-6fa2af66d149", "record_id": "flaws_cloudtrail:0000027:16281c03-520b-46f5-8945-6fa2af66d149", "row_index": 27, "timestamp": "2019-03-25T20:04:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16281c03-520b-46f5-8945-6fa2af66d149", "eventTime": "2019-03-25T20:04:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16281c03-520b-46f5-8945-6fa2af66d149", "record_id": "flaws_cloudtrail:0000028:16281c03-520b-46f5-8945-6fa2af66d149", "row_index": 28, "timestamp": "2019-03-25T20:04:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "250.217.96.254", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16281c03-520b-46f5-8945-6fa2af66d149", "eventTime": "2019-03-25T20:04:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "250.217.96.254", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b984b82e-23a0-4d17-a74d-8d1cc1fa838c", "record_id": "flaws_cloudtrail:0000029:b984b82e-23a0-4d17-a74d-8d1cc1fa838c", "row_index": 29, "timestamp": "2019-03-25T20:13:32Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 511, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b984b82e-23a0-4d17-a74d-8d1cc1fa838c", "eventTime": "2019-03-25T20:13:32Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34fa3b2b-2171-41e7-ad18-d5bc36e8ccc4", "record_id": "flaws_cloudtrail:0000030:34fa3b2b-2171-41e7-ad18-d5bc36e8ccc4", "row_index": 30, "timestamp": "2019-03-25T20:13:53Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 540, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34fa3b2b-2171-41e7-ad18-d5bc36e8ccc4", "eventTime": "2019-03-25T20:13:53Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4e339a2-fa0a-47b3-be26-927c7d19c20b", "record_id": "flaws_cloudtrail:0000031:e4e339a2-fa0a-47b3-be26-927c7d19c20b", "row_index": 31, "timestamp": "2019-03-25T20:15:07Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 540, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4e339a2-fa0a-47b3-be26-927c7d19c20b", "eventTime": "2019-03-25T20:15:07Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d9c6aae-ece0-44f6-bd30-7b780bab4362", "record_id": "flaws_cloudtrail:0000032:3d9c6aae-ece0-44f6-bd30-7b780bab4362", "row_index": 32, "timestamp": "2019-03-25T20:15:47Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 543, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d9c6aae-ece0-44f6-bd30-7b780bab4362", "eventTime": "2019-03-25T20:15:47Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a2bd9fc-36c0-416c-8a86-13e24b3e1a4a", "record_id": "flaws_cloudtrail:0000033:3a2bd9fc-36c0-416c-8a86-13e24b3e1a4a", "row_index": 33, "timestamp": "2019-03-25T20:17:03Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 541, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a2bd9fc-36c0-416c-8a86-13e24b3e1a4a", "eventTime": "2019-03-25T20:17:03Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab2a1dbf-2291-4caa-b278-d7f1f8b2f8dd", "record_id": "flaws_cloudtrail:0000034:ab2a1dbf-2291-4caa-b278-d7f1f8b2f8dd", "row_index": 34, "timestamp": "2019-03-25T20:18:26Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 511, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab2a1dbf-2291-4caa-b278-d7f1f8b2f8dd", "eventTime": "2019-03-25T20:18:26Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbcb3e4a-decf-425c-8696-b9fe018c487a", "record_id": "flaws_cloudtrail:0000035:fbcb3e4a-decf-425c-8696-b9fe018c487a", "row_index": 35, "timestamp": "2019-03-25T20:20:00Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 506, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbcb3e4a-decf-425c-8696-b9fe018c487a", "eventTime": "2019-03-25T20:20:00Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "574c2be2-caa6-4bf9-90aa-013cee19be3d", "record_id": "flaws_cloudtrail:0000036:574c2be2-caa6-4bf9-90aa-013cee19be3d", "row_index": 36, "timestamp": "2019-03-25T20:21:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 516, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "574c2be2-caa6-4bf9-90aa-013cee19be3d", "eventTime": "2019-03-25T20:21:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "798967a2-389f-40e4-aa17-fdd196794424", "record_id": "flaws_cloudtrail:0000037:798967a2-389f-40e4-aa17-fdd196794424", "row_index": 37, "timestamp": "2019-03-25T20:21:55Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 510, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "798967a2-389f-40e4-aa17-fdd196794424", "eventTime": "2019-03-25T20:21:55Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d15f362-15b3-4681-8342-3b7cf990c26a", "record_id": "flaws_cloudtrail:0000038:3d15f362-15b3-4681-8342-3b7cf990c26a", "row_index": 38, "timestamp": "2019-03-25T20:23:30Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 504, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d15f362-15b3-4681-8342-3b7cf990c26a", "eventTime": "2019-03-25T20:23:30Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4578a521-a875-4bff-8fee-29b42cf203f1", "record_id": "flaws_cloudtrail:0000039:4578a521-a875-4bff-8fee-29b42cf203f1", "row_index": 39, "timestamp": "2019-03-25T20:25:01Z", "event_type": "ListFunctions", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 510, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4578a521-a875-4bff-8fee-29b42cf203f1", "eventTime": "2019-03-25T20:25:01Z", "eventName": "ListFunctions", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9e2ada5-71dd-4516-88e8-c7754675804a", "record_id": "flaws_cloudtrail:0000040:c9e2ada5-71dd-4516-88e8-c7754675804a", "row_index": 40, "timestamp": "2019-03-25T20:25:56Z", "event_type": "DescribeDBInstances", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA43OR0Y76HEXQPWJX", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "14.115.130.204", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 513, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9e2ada5-71dd-4516-88e8-c7754675804a", "eventTime": "2019-03-25T20:25:56Z", "eventName": "DescribeDBInstances", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "14.115.130.204", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA43OR0Y76HEXQPWJX", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ed2b24d-8303-4d47-b171-15a969ecb08c", "record_id": "flaws_cloudtrail:0000041:0ed2b24d-8303-4d47-b171-15a969ecb08c", "row_index": 41, "timestamp": "2019-03-25T22:19:53Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "105.253.251.205", "user_agent": "[aws-cli/1.16.104 Python/3.7.2 Windows/10 botocore/1.12.94]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ed2b24d-8303-4d47-b171-15a969ecb08c", "eventTime": "2019-03-25T22:19:53Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "105.253.251.205", "userAgent": "[aws-cli/1.16.104 Python/3.7.2 Windows/10 botocore/1.12.94]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ed2b24d-8303-4d47-b171-15a969ecb08c", "record_id": "flaws_cloudtrail:0000042:0ed2b24d-8303-4d47-b171-15a969ecb08c", "row_index": 42, "timestamp": "2019-03-25T22:19:53Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "105.253.251.205", "user_agent": "[aws-cli/1.16.104 Python/3.7.2 Windows/10 botocore/1.12.94]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ed2b24d-8303-4d47-b171-15a969ecb08c", "eventTime": "2019-03-25T22:19:53Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "105.253.251.205", "userAgent": "[aws-cli/1.16.104 Python/3.7.2 Windows/10 botocore/1.12.94]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ace2365-39d8-4581-bba2-c5f0bfa348b2", "record_id": "flaws_cloudtrail:0000043:8ace2365-39d8-4581-bba2-c5f0bfa348b2", "row_index": 43, "timestamp": "2019-03-25T23:50:04Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "[aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ace2365-39d8-4581-bba2-c5f0bfa348b2", "eventTime": "2019-03-25T23:50:04Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "[aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ace2365-39d8-4581-bba2-c5f0bfa348b2", "record_id": "flaws_cloudtrail:0000044:8ace2365-39d8-4581-bba2-c5f0bfa348b2", "row_index": 44, "timestamp": "2019-03-25T23:50:04Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "[aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ace2365-39d8-4581-bba2-c5f0bfa348b2", "eventTime": "2019-03-25T23:50:04Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "[aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df540a3c-e6d1-417f-8b36-e8f8172cc3b7", "record_id": "flaws_cloudtrail:0000045:df540a3c-e6d1-417f-8b36-e8f8172cc3b7", "row_index": 45, "timestamp": "2019-03-26T00:03:26Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df540a3c-e6d1-417f-8b36-e8f8172cc3b7", "eventTime": "2019-03-26T00:03:26Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df540a3c-e6d1-417f-8b36-e8f8172cc3b7", "record_id": "flaws_cloudtrail:0000046:df540a3c-e6d1-417f-8b36-e8f8172cc3b7", "row_index": 46, "timestamp": "2019-03-26T00:03:26Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df540a3c-e6d1-417f-8b36-e8f8172cc3b7", "eventTime": "2019-03-26T00:03:26Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "127c01b1-723b-4ac7-a3b9-604530dbc9c8c", "record_id": "flaws_cloudtrail:0000047:127c01b1-723b-4ac7-a3b9-604530dbc9c8c", "row_index": 47, "timestamp": "2019-03-26T00:03:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "127c01b1-723b-4ac7-a3b9-604530dbc9c8c", "eventTime": "2019-03-26T00:03:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "127c01b1-723b-4ac7-a3b9-604530dbc9c8c", "record_id": "flaws_cloudtrail:0000048:127c01b1-723b-4ac7-a3b9-604530dbc9c8c", "row_index": 48, "timestamp": "2019-03-26T00:03:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "127c01b1-723b-4ac7-a3b9-604530dbc9c8c", "eventTime": "2019-03-26T00:03:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7bbe1654-3376-49af-8edf-374f85553b0e", "record_id": "flaws_cloudtrail:0000049:7bbe1654-3376-49af-8edf-374f85553b0e", "row_index": 49, "timestamp": "2019-03-26T00:03:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7bbe1654-3376-49af-8edf-374f85553b0e", "eventTime": "2019-03-26T00:03:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwQ0JIYWkzTEhEQytseHBRQll6THdSbE5ldkZ4a01WWDA2SGJQTG5takNDT0xxUlA0b3E4Y2JvRDhXYTllQmNvdE1iT3NydU1ZVTNlVzdCUDZ1b1p4QUFYbE1KQlVvV2xYZkR3QnRnOE45NytiaWh4UEZqQ2VNOW1CK3JqUjFVUlNjVUo4OXRRc05jcU11S201NTVzZmRsYWNQS1pUWnpHNG5iQURSZ0xIZ05lNUtrZGRQSTBFdnRaczM3bXE4aC9zTVRQNi9IbDhEcERMQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7bbe1654-3376-49af-8edf-374f85553b0e", "record_id": "flaws_cloudtrail:0000050:7bbe1654-3376-49af-8edf-374f85553b0e", "row_index": 50, "timestamp": "2019-03-26T00:03:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7bbe1654-3376-49af-8edf-374f85553b0e", "eventTime": "2019-03-26T00:03:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwQ0JIYWkzTEhEQytseHBRQll6THdSbE5ldkZ4a01WWDA2SGJQTG5takNDT0xxUlA0b3E4Y2JvRDhXYTllQmNvdE1iT3NydU1ZVTNlVzdCUDZ1b1p4QUFYbE1KQlVvV2xYZkR3QnRnOE45NytiaWh4UEZqQ2VNOW1CK3JqUjFVUlNjVUo4OXRRc05jcU11S201NTVzZmRsYWNQS1pUWnpHNG5iQURSZ0xIZ05lNUtrZGRQSTBFdnRaczM3bXE4aC9zTVRQNi9IbDhEcERMQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4059e7f-1c21-4a76-b8ab-bbceda5f4c7e", "record_id": "flaws_cloudtrail:0000051:e4059e7f-1c21-4a76-b8ab-bbceda5f4c7e", "row_index": 51, "timestamp": "2019-03-26T00:03:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4059e7f-1c21-4a76-b8ab-bbceda5f4c7e", "eventTime": "2019-03-26T00:03:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFdzg0M3VsTWorSURORU9UR1F6NjcvM2Y1RnFOQ2dLTjlBSS9WR1d5bklRcUsyeHpwOWthV3psczFrUU0wdFk3MlZtRkFNa1FHeUlpNkZwVkowYTMzeS92ZkJjNjdWak43MjB2QWdMRHRSR3o0QWF2aTRXWWlBb2dOZEMrOS9hVERuQmJleVo5bUtMWi9VaU8raURCOHZZL1VzK2J5Q1hvRmtRMmFITkdQV2NFU1NtN09DNmVlbE1WbEswcmY3NnRiTGpNWEViNUlrRkV4QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4059e7f-1c21-4a76-b8ab-bbceda5f4c7e", "record_id": "flaws_cloudtrail:0000052:e4059e7f-1c21-4a76-b8ab-bbceda5f4c7e", "row_index": 52, "timestamp": "2019-03-26T00:03:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4059e7f-1c21-4a76-b8ab-bbceda5f4c7e", "eventTime": "2019-03-26T00:03:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFdzg0M3VsTWorSURORU9UR1F6NjcvM2Y1RnFOQ2dLTjlBSS9WR1d5bklRcUsyeHpwOWthV3psczFrUU0wdFk3MlZtRkFNa1FHeUlpNkZwVkowYTMzeS92ZkJjNjdWak43MjB2QWdMRHRSR3o0QWF2aTRXWWlBb2dOZEMrOS9hVERuQmJleVo5bUtMWi9VaU8raURCOHZZL1VzK2J5Q1hvRmtRMmFITkdQV2NFU1NtN09DNmVlbE1WbEswcmY3NnRiTGpNWEViNUlrRkV4QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b77a3dd-57ed-4b80-b080-5de2fa2dbece", "record_id": "flaws_cloudtrail:0000053:9b77a3dd-57ed-4b80-b080-5de2fa2dbece", "row_index": 53, "timestamp": "2019-03-26T00:03:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b77a3dd-57ed-4b80-b080-5de2fa2dbece", "eventTime": "2019-03-26T00:03:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnaERJQkxOdFgwMDBFSW0zb0hHaXJOUmlCc0xtRVNITEJNUXNCZm1DZ0ZNV0w3YUJRVTJwMU5Kb1Bubkp6TVkxaW9zWTFzM29KU2dDNTNsWnpqa3VVcHh0S1BlLzd2TnVPMDVKWjIrYWFNVjhVVS81N2FhQnJhWTNkZFd6Rjd5b3VBOUdZTnMyYnFnb0pOOUdnUkJQcS9oVExNR3JXQ0N1QmN3RFZmN1kyTWRoUGpLdGZ6U2F0NU9WS2xFejZFdmdpeThFRTl6Mk53PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b77a3dd-57ed-4b80-b080-5de2fa2dbece", "record_id": "flaws_cloudtrail:0000054:9b77a3dd-57ed-4b80-b080-5de2fa2dbece", "row_index": 54, "timestamp": "2019-03-26T00:03:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b77a3dd-57ed-4b80-b080-5de2fa2dbece", "eventTime": "2019-03-26T00:03:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnaERJQkxOdFgwMDBFSW0zb0hHaXJOUmlCc0xtRVNITEJNUXNCZm1DZ0ZNV0w3YUJRVTJwMU5Kb1Bubkp6TVkxaW9zWTFzM29KU2dDNTNsWnpqa3VVcHh0S1BlLzd2TnVPMDVKWjIrYWFNVjhVVS81N2FhQnJhWTNkZFd6Rjd5b3VBOUdZTnMyYnFnb0pOOUdnUkJQcS9oVExNR3JXQ0N1QmN3RFZmN1kyTWRoUGpLdGZ6U2F0NU9WS2xFejZFdmdpeThFRTl6Mk53PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "105df9b8-6de5-4bbe-837c-1c3bceb9a221", "record_id": "flaws_cloudtrail:0000055:105df9b8-6de5-4bbe-837c-1c3bceb9a221", "row_index": 55, "timestamp": "2019-03-26T00:03:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "105df9b8-6de5-4bbe-837c-1c3bceb9a221", "eventTime": "2019-03-26T00:03:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5dFBpTmM5MmFyM3JVM0xEMmExL0xlYXNlODJpMjMxSW5ubXRxNFNwdlAwS24ybnBNQVh2Ry91QlNkeVNKYmh3OGJGMWE3MWI1djNOcDk5WWFZVDZtSndlV1BsWlk5disyYTdoY3d6Q0l5RytoNm9YNlg2SjNvVHpzK1BzTWFDTnl6S01VcFJqTU1sc1FwWjQwLzVCbU03T1p4cjlJWUlZaHNqRlJtS3NTT21uL0dkMjZ4T1hxUFZBOW9yMFhFb3NLZ0wxQUFtNkN4aUhLQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "105df9b8-6de5-4bbe-837c-1c3bceb9a221", "record_id": "flaws_cloudtrail:0000056:105df9b8-6de5-4bbe-837c-1c3bceb9a221", "row_index": 56, "timestamp": "2019-03-26T00:03:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "105df9b8-6de5-4bbe-837c-1c3bceb9a221", "eventTime": "2019-03-26T00:03:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5dFBpTmM5MmFyM3JVM0xEMmExL0xlYXNlODJpMjMxSW5ubXRxNFNwdlAwS24ybnBNQVh2Ry91QlNkeVNKYmh3OGJGMWE3MWI1djNOcDk5WWFZVDZtSndlV1BsWlk5disyYTdoY3d6Q0l5RytoNm9YNlg2SjNvVHpzK1BzTWFDTnl6S01VcFJqTU1sc1FwWjQwLzVCbU03T1p4cjlJWUlZaHNqRlJtS3NTT21uL0dkMjZ4T1hxUFZBOW9yMFhFb3NLZ0wxQUFtNkN4aUhLQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c98e507e-00ae-4a7e-811f-21591a199353", "record_id": "flaws_cloudtrail:0000057:c98e507e-00ae-4a7e-811f-21591a199353", "row_index": 57, "timestamp": "2019-03-26T00:03:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c98e507e-00ae-4a7e-811f-21591a199353", "eventTime": "2019-03-26T00:03:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOenJjdml1NVdYQTFVczlwZkJOcnNqNFJ1T0ZIVXEySUM1OGlVUE5mc3lDL1VaUHdSbzJ4dXZ2QXRuUHFBL00xNW1XN1p5Tk12bGNleGZIT0pkVE5haVpnTnZqUk9rSjBDV01sOXJPU1EzQitCOW82QWw5YkQ0SENZZGxoVlcxSk1PVG9xdDhlWXZZUFVQcTdKWW9YTHRhRndXcjBoOG1MVjkzek5udnZsRGN6M3JIaDMydXlaQWVlQmU0aHpteTZ4R0ZyQ2RGSStqdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c98e507e-00ae-4a7e-811f-21591a199353", "record_id": "flaws_cloudtrail:0000058:c98e507e-00ae-4a7e-811f-21591a199353", "row_index": 58, "timestamp": "2019-03-26T00:03:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c98e507e-00ae-4a7e-811f-21591a199353", "eventTime": "2019-03-26T00:03:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOenJjdml1NVdYQTFVczlwZkJOcnNqNFJ1T0ZIVXEySUM1OGlVUE5mc3lDL1VaUHdSbzJ4dXZ2QXRuUHFBL00xNW1XN1p5Tk12bGNleGZIT0pkVE5haVpnTnZqUk9rSjBDV01sOXJPU1EzQitCOW82QWw5YkQ0SENZZGxoVlcxSk1PVG9xdDhlWXZZUFVQcTdKWW9YTHRhRndXcjBoOG1MVjkzek5udnZsRGN6M3JIaDMydXlaQWVlQmU0aHpteTZ4R0ZyQ2RGSStqdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb0f7a46-7539-4b4a-9770-881202f0b333", "record_id": "flaws_cloudtrail:0000059:eb0f7a46-7539-4b4a-9770-881202f0b333", "row_index": 59, "timestamp": "2019-03-26T00:03:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb0f7a46-7539-4b4a-9770-881202f0b333", "eventTime": "2019-03-26T00:03:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvQWUvc3UzTG0zZFZLcTFjU0h3aE1peFIxcVVKRFJ1K05hZlV0aTd2eHJRbWNhRnY0eTYxK3lJc0V3YnJVZHVTdG1MUlFQenkrSE9EOUMxYndMNDVWTHkrMDh5bk1HNzN0V2tYNEx3UE82Vkg2VGliUTl3OGFza1RNQnlzUm1uNncyaGhrazJNeWtYOTJHRjR5OG9nUGlka04wZHhKV2pBM3pPeWdCV3JnbzUvckZVRTI0WDhqdXdWWGNZWWxJNW9IZjBmTXErMU1Ga3lDZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb0f7a46-7539-4b4a-9770-881202f0b333", "record_id": "flaws_cloudtrail:0000060:eb0f7a46-7539-4b4a-9770-881202f0b333", "row_index": 60, "timestamp": "2019-03-26T00:03:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb0f7a46-7539-4b4a-9770-881202f0b333", "eventTime": "2019-03-26T00:03:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvQWUvc3UzTG0zZFZLcTFjU0h3aE1peFIxcVVKRFJ1K05hZlV0aTd2eHJRbWNhRnY0eTYxK3lJc0V3YnJVZHVTdG1MUlFQenkrSE9EOUMxYndMNDVWTHkrMDh5bk1HNzN0V2tYNEx3UE82Vkg2VGliUTl3OGFza1RNQnlzUm1uNncyaGhrazJNeWtYOTJHRjR5OG9nUGlka04wZHhKV2pBM3pPeWdCV3JnbzUvckZVRTI0WDhqdXdWWGNZWWxJNW9IZjBmTXErMU1Ga3lDZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74b7c66d-9857-4524-9ae7-3efaae5aaa0d", "record_id": "flaws_cloudtrail:0000061:74b7c66d-9857-4524-9ae7-3efaae5aaa0d", "row_index": 61, "timestamp": "2019-03-26T00:03:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74b7c66d-9857-4524-9ae7-3efaae5aaa0d", "eventTime": "2019-03-26T00:03:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKUlUxdllqVWFOUG1sQUJWNW0yV3YxMUp4ZS80WGE5NmJlUCtsdGtqSXhicjZONG9pOUhkdmxRM0UxZ2xVdWFZOGlVU1d2YjdxYTVZQU5XR1lyQVUzQ2JtSWp6YXliUHlOY1pwYXFDRWIvS2o3SG1WbkJGcVVMaDVVcm1VVzNQa0ZYR3ZqTW94VjYrbjJwdVRaQnpjNlV1QnlaMWVxUUR5OFpHS0JBRHB5NTM0TWJIcXV1TXF2VDNXL1lOcW9nRkJOQ21CN2JDdHRYNTUyZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74b7c66d-9857-4524-9ae7-3efaae5aaa0d", "record_id": "flaws_cloudtrail:0000062:74b7c66d-9857-4524-9ae7-3efaae5aaa0d", "row_index": 62, "timestamp": "2019-03-26T00:03:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74b7c66d-9857-4524-9ae7-3efaae5aaa0d", "eventTime": "2019-03-26T00:03:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKUlUxdllqVWFOUG1sQUJWNW0yV3YxMUp4ZS80WGE5NmJlUCtsdGtqSXhicjZONG9pOUhkdmxRM0UxZ2xVdWFZOGlVU1d2YjdxYTVZQU5XR1lyQVUzQ2JtSWp6YXliUHlOY1pwYXFDRWIvS2o3SG1WbkJGcVVMaDVVcm1VVzNQa0ZYR3ZqTW94VjYrbjJwdVRaQnpjNlV1QnlaMWVxUUR5OFpHS0JBRHB5NTM0TWJIcXV1TXF2VDNXL1lOcW9nRkJOQ21CN2JDdHRYNTUyZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bba41f7d-1006-438a-bdf4-a0d0508a2db8", "record_id": "flaws_cloudtrail:0000063:bba41f7d-1006-438a-bdf4-a0d0508a2db8", "row_index": 63, "timestamp": "2019-03-26T00:03:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bba41f7d-1006-438a-bdf4-a0d0508a2db8", "eventTime": "2019-03-26T00:03:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIOXNXRUwwbFN6VHcvdjVjNWkvZ3hVeGFKZUdVcWhQZEdkcHhMakYrT3lxNGdneGZIRjk2SnZFS3JNdHJUMEFzRDA3aGJzQTVvMDdYaURyV2NVTVMxU0p5MTB6TTNmQWFEVjN5cTVRVHU5NDIzbGdjd0lLUmVLVytSRXNSa09VREpKd1k5cWpacnQ1OTNlQzE3OXNJeDMydWxRV0xtUDBkelJaYVVKR1YyWGpoZmY1ZEJ6b2VzbEVqSjhUcWQyYVRJR0J0d1hreUNYcDluUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bba41f7d-1006-438a-bdf4-a0d0508a2db8", "record_id": "flaws_cloudtrail:0000064:bba41f7d-1006-438a-bdf4-a0d0508a2db8", "row_index": 64, "timestamp": "2019-03-26T00:03:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bba41f7d-1006-438a-bdf4-a0d0508a2db8", "eventTime": "2019-03-26T00:03:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIOXNXRUwwbFN6VHcvdjVjNWkvZ3hVeGFKZUdVcWhQZEdkcHhMakYrT3lxNGdneGZIRjk2SnZFS3JNdHJUMEFzRDA3aGJzQTVvMDdYaURyV2NVTVMxU0p5MTB6TTNmQWFEVjN5cTVRVHU5NDIzbGdjd0lLUmVLVytSRXNSa09VREpKd1k5cWpacnQ1OTNlQzE3OXNJeDMydWxRV0xtUDBkelJaYVVKR1YyWGpoZmY1ZEJ6b2VzbEVqSjhUcWQyYVRJR0J0d1hreUNYcDluUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c383641-b43b-49af-b5cf-40aa5f96e752", "record_id": "flaws_cloudtrail:0000065:c383641-b43b-49af-b5cf-40aa5f96e752", "row_index": 65, "timestamp": "2019-03-26T00:03:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c383641-b43b-49af-b5cf-40aa5f96e752", "eventTime": "2019-03-26T00:03:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUVmlsS2VoTGV5ZUZZcWtxYWs1UGZOcjZOeWljeWpOTFZ4dEdzTmsvamZseVRYU0taRkZGNlgvNmcwWFJkQngvMW1adGZNNkdSUnNZRHZ2NFRFUUJCdExzSjRCWGVwdWpPWEtDcTJReXJKNnZSWHJyVElnaGZ4NklHckUvNU9qN3laaWpnSXBvc2JLYzVKYkFqeXdlMjJ1MEhMT1dPSDFjS1dQbzVERXhtQVRQb3BCUXJvVW9rV1VzMUd1ako5bzJ1N0llcWdMYWZXNzdIUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c383641-b43b-49af-b5cf-40aa5f96e752", "record_id": "flaws_cloudtrail:0000066:c383641-b43b-49af-b5cf-40aa5f96e752", "row_index": 66, "timestamp": "2019-03-26T00:03:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c383641-b43b-49af-b5cf-40aa5f96e752", "eventTime": "2019-03-26T00:03:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUVmlsS2VoTGV5ZUZZcWtxYWs1UGZOcjZOeWljeWpOTFZ4dEdzTmsvamZseVRYU0taRkZGNlgvNmcwWFJkQngvMW1adGZNNkdSUnNZRHZ2NFRFUUJCdExzSjRCWGVwdWpPWEtDcTJReXJKNnZSWHJyVElnaGZ4NklHckUvNU9qN3laaWpnSXBvc2JLYzVKYkFqeXdlMjJ1MEhMT1dPSDFjS1dQbzVERXhtQVRQb3BCUXJvVW9rV1VzMUd1ako5bzJ1N0llcWdMYWZXNzdIUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8ce0697-ead1-4a66-b5d2-eb3af7c293a5", "record_id": "flaws_cloudtrail:0000067:e8ce0697-ead1-4a66-b5d2-eb3af7c293a5", "row_index": 67, "timestamp": "2019-03-26T00:03:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8ce0697-ead1-4a66-b5d2-eb3af7c293a5", "eventTime": "2019-03-26T00:03:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwMktSKzJ6MmxGMXdQbndkY2JYVXYyY3VXMTIxYk9mWmhLaTcraGduSFYyVkN1MC9iT3dhb0pEaEdDSUNSaXhEdDg5b00rQk9jMkNlbkZEZmdMVVdxSloyR1FjRTFFaDFCTU85dDJiRFpxemx5azhFNW5qOG9mMXFLNUVRZGVOcFJkY0NUODRhZVU4UitCMk9tTEc2WUtTZVhIcGY5REtTQzN2UmQrQTNWSXVtQ1VQakF2TTRyRVYvazVtaWVFOTNma0pHK0RhL0hBUGFidz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8ce0697-ead1-4a66-b5d2-eb3af7c293a5", "record_id": "flaws_cloudtrail:0000068:e8ce0697-ead1-4a66-b5d2-eb3af7c293a5", "row_index": 68, "timestamp": "2019-03-26T00:03:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8ce0697-ead1-4a66-b5d2-eb3af7c293a5", "eventTime": "2019-03-26T00:03:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwMktSKzJ6MmxGMXdQbndkY2JYVXYyY3VXMTIxYk9mWmhLaTcraGduSFYyVkN1MC9iT3dhb0pEaEdDSUNSaXhEdDg5b00rQk9jMkNlbkZEZmdMVVdxSloyR1FjRTFFaDFCTU85dDJiRFpxemx5azhFNW5qOG9mMXFLNUVRZGVOcFJkY0NUODRhZVU4UitCMk9tTEc2WUtTZVhIcGY5REtTQzN2UmQrQTNWSXVtQ1VQakF2TTRyRVYvazVtaWVFOTNma0pHK0RhL0hBUGFidz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d54e98d5-7124-49a1-83dd-3009896f0f2d", "record_id": "flaws_cloudtrail:0000069:d54e98d5-7124-49a1-83dd-3009896f0f2d", "row_index": 69, "timestamp": "2019-03-26T00:04:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d54e98d5-7124-49a1-83dd-3009896f0f2d", "eventTime": "2019-03-26T00:04:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZSzdmaGpoVGkzS3BvU2FnNnFyRC93ODMvVllPT05qTjhUcTRPZ0M4bWtmVG15SGlXZ2h3OWh2b0pETGpWejdQaTh0dHpONWl5bDdua3dsblB4YUV1RitIRkRRQVV2Rko2ZkdyNndRbUpaRjh4THJLdTdHek9nVGlVNXVObWZhUkgydUp2MnE1SlkxVDVLbFZhUFp4RVFxbU1JUzZ5alB5cXN2NFFPcDZjOHJPVUp6SVo1enhwK2dTM2tsczl1Si90alVGbDQrK1NvMFhpZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d54e98d5-7124-49a1-83dd-3009896f0f2d", "record_id": "flaws_cloudtrail:0000070:d54e98d5-7124-49a1-83dd-3009896f0f2d", "row_index": 70, "timestamp": "2019-03-26T00:04:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d54e98d5-7124-49a1-83dd-3009896f0f2d", "eventTime": "2019-03-26T00:04:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZSzdmaGpoVGkzS3BvU2FnNnFyRC93ODMvVllPT05qTjhUcTRPZ0M4bWtmVG15SGlXZ2h3OWh2b0pETGpWejdQaTh0dHpONWl5bDdua3dsblB4YUV1RitIRkRRQVV2Rko2ZkdyNndRbUpaRjh4THJLdTdHek9nVGlVNXVObWZhUkgydUp2MnE1SlkxVDVLbFZhUFp4RVFxbU1JUzZ5alB5cXN2NFFPcDZjOHJPVUp6SVo1enhwK2dTM2tsczl1Si90alVGbDQrK1NvMFhpZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e80b5619-bee8-4b14-ac42-51337c554", "record_id": "flaws_cloudtrail:0000071:e80b5619-bee8-4b14-ac42-51337c554", "row_index": 71, "timestamp": "2019-03-26T00:04:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e80b5619-bee8-4b14-ac42-51337c554", "eventTime": "2019-03-26T00:04:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3Z2xxVk4zNWYzSXp0bThwZHlpT3JKUmNHVEs0UU5FOU95V1BubmZxTjlvUzlOc2pXempNVThFUEZwQkFKdm9MTGdJS0g0ZzF5eVBFQmV1SkV3Y1d4V2hiTGpSd1ZQT2xMa1JIQnJIZXk4TkJGVkRjWUFXUE1BWXNKZ21xZnJvSFZGU1ZqWStqMG8wdHpPVENzTTkzTW1oWVdBSzJ3N2lpakdGN0l1SlZFeUJOVmp3MEltQWpaYnhLQlFIcEVRbU45TGQ1N3lUQlh5K0dxZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e80b5619-bee8-4b14-ac42-51337c554", "record_id": "flaws_cloudtrail:0000072:e80b5619-bee8-4b14-ac42-51337c554", "row_index": 72, "timestamp": "2019-03-26T00:04:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e80b5619-bee8-4b14-ac42-51337c554", "eventTime": "2019-03-26T00:04:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3Z2xxVk4zNWYzSXp0bThwZHlpT3JKUmNHVEs0UU5FOU95V1BubmZxTjlvUzlOc2pXempNVThFUEZwQkFKdm9MTGdJS0g0ZzF5eVBFQmV1SkV3Y1d4V2hiTGpSd1ZQT2xMa1JIQnJIZXk4TkJGVkRjWUFXUE1BWXNKZ21xZnJvSFZGU1ZqWStqMG8wdHpPVENzTTkzTW1oWVdBSzJ3N2lpakdGN0l1SlZFeUJOVmp3MEltQWpaYnhLQlFIcEVRbU45TGQ1N3lUQlh5K0dxZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7665aa89-e205-4d06-897d-1a5332683fef", "record_id": "flaws_cloudtrail:0000073:7665aa89-e205-4d06-897d-1a5332683fef", "row_index": 73, "timestamp": "2019-03-26T00:04:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7665aa89-e205-4d06-897d-1a5332683fef", "eventTime": "2019-03-26T00:04:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhd0lpenRPZU5qdWtHTVFpcEFrTmhnUFhOWk5KaDArRUx0NmxzZWRRUURTbEJLOG5aK2RkK3RITnZwWXUwYncrQmNxK2ErRVo5QnR1ekFib0ZQVTRqYTFJeVVERjdEZWJnSDVHRXU4aUZZTWs2d1hpU1FzOEx0eUZlMWg2MTZUa2FPcDNhOU4yL2V2WXRZTjJhNWo0U3lXbTRjNkN3TC9odzhWRDY4dVBkRGJUQmdoRHBaUGkzQnNuejNESTFNaVlyNVovQ3kvY2NnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7665aa89-e205-4d06-897d-1a5332683fef", "record_id": "flaws_cloudtrail:0000074:7665aa89-e205-4d06-897d-1a5332683fef", "row_index": 74, "timestamp": "2019-03-26T00:04:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7665aa89-e205-4d06-897d-1a5332683fef", "eventTime": "2019-03-26T00:04:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhd0lpenRPZU5qdWtHTVFpcEFrTmhnUFhOWk5KaDArRUx0NmxzZWRRUURTbEJLOG5aK2RkK3RITnZwWXUwYncrQmNxK2ErRVo5QnR1ekFib0ZQVTRqYTFJeVVERjdEZWJnSDVHRXU4aUZZTWs2d1hpU1FzOEx0eUZlMWg2MTZUa2FPcDNhOU4yL2V2WXRZTjJhNWo0U3lXbTRjNkN3TC9odzhWRDY4dVBkRGJUQmdoRHBaUGkzQnNuejNESTFNaVlyNVovQ3kvY2NnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5e4df39-e572-4f8a-993d-20a8889f5f57", "record_id": "flaws_cloudtrail:0000075:d5e4df39-e572-4f8a-993d-20a8889f5f57", "row_index": 75, "timestamp": "2019-03-26T00:04:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5e4df39-e572-4f8a-993d-20a8889f5f57", "eventTime": "2019-03-26T00:04:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwNi9hOU9Qbld1bnJWaThJL3lNZnBkRFpWd0w3UG5WckFadWpuUVhQby95WURnTS9kNEFxYjdoWnlJKzR2UnRTU01WMWNTdGRYR05QQXVLNVRJOG5Sd1puZnJVMzJFUG92aU1PUUpVZnZETUVRV0dwVGF4Rkc1VkZtY0N4cE1qcHJublhzdUhDOFg2UVk0QWVPMmRxRE01TERQNmZDcWxXMTFyQTdrbWUzLzdOZ001QU1RQmtGajU2bldLcHJTUnFkbWhDZTExdVBwMUdQUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5e4df39-e572-4f8a-993d-20a8889f5f57", "record_id": "flaws_cloudtrail:0000076:d5e4df39-e572-4f8a-993d-20a8889f5f57", "row_index": 76, "timestamp": "2019-03-26T00:04:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5e4df39-e572-4f8a-993d-20a8889f5f57", "eventTime": "2019-03-26T00:04:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwNi9hOU9Qbld1bnJWaThJL3lNZnBkRFpWd0w3UG5WckFadWpuUVhQby95WURnTS9kNEFxYjdoWnlJKzR2UnRTU01WMWNTdGRYR05QQXVLNVRJOG5Sd1puZnJVMzJFUG92aU1PUUpVZnZETUVRV0dwVGF4Rkc1VkZtY0N4cE1qcHJublhzdUhDOFg2UVk0QWVPMmRxRE01TERQNmZDcWxXMTFyQTdrbWUzLzdOZ001QU1RQmtGajU2bldLcHJTUnFkbWhDZTExdVBwMUdQUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78b29803-a76f-43bf-8761-88811f6ce2", "record_id": "flaws_cloudtrail:0000077:78b29803-a76f-43bf-8761-88811f6ce2", "row_index": 77, "timestamp": "2019-03-26T00:04:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78b29803-a76f-43bf-8761-88811f6ce2", "eventTime": "2019-03-26T00:04:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEWThIOElKaWF1TnFyaVRoQWpiVUxpYk52eEpQN3BiVzJkakwrdjRVUC9KNkd0VE1RZk13NTR5M3hJLzgxM1JwWFd1TWZsckJvWnArai8wWmhSTURLaWFzaDdRODdMcmY3TGRlL1B6S2lUZVJXN292ZFo1RTlPQ0JWbVQxOVU0dE00UGZLYWQrTE05NzRDdWxMRGYyK2JrdThxb3FmS3U4ckdtdHRXdGZrT0tEWjVDNjBxV1ZYVXA5L0gzbm9hOGhPZVJYT1Rta09xQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78b29803-a76f-43bf-8761-88811f6ce2", "record_id": "flaws_cloudtrail:0000078:78b29803-a76f-43bf-8761-88811f6ce2", "row_index": 78, "timestamp": "2019-03-26T00:04:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78b29803-a76f-43bf-8761-88811f6ce2", "eventTime": "2019-03-26T00:04:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEWThIOElKaWF1TnFyaVRoQWpiVUxpYk52eEpQN3BiVzJkakwrdjRVUC9KNkd0VE1RZk13NTR5M3hJLzgxM1JwWFd1TWZsckJvWnArai8wWmhSTURLaWFzaDdRODdMcmY3TGRlL1B6S2lUZVJXN292ZFo1RTlPQ0JWbVQxOVU0dE00UGZLYWQrTE05NzRDdWxMRGYyK2JrdThxb3FmS3U4ckdtdHRXdGZrT0tEWjVDNjBxV1ZYVXA5L0gzbm9hOGhPZVJYT1Rta09xQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52d413b6-bfe0-452d-addf-d158e69374b7", "record_id": "flaws_cloudtrail:0000079:52d413b6-bfe0-452d-addf-d158e69374b7", "row_index": 79, "timestamp": "2019-03-26T00:04:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52d413b6-bfe0-452d-addf-d158e69374b7", "eventTime": "2019-03-26T00:04:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5Mzl5cUhQdllTalE4Y0Y4d0FJc3FXSnVZa2xqczB5QlNlUmlVeXMwbjdRQ3pLZlV4WklReWEvMGxBYlpISEF4a1A5L3JwelRybENOeTl6UDJ0OXQweWphWkZYdkYwb3Z0bTV1QVRETlRUN3BBcnd5VFNLQWZobVBXZkhiOGcxZmFQNUNhK0twbVcvV2thcEEzbS9xalhKWUpINi9nbFd5THY0K3FkTWY4a0RTZkJ0bmljYy96dGxKNVVEUE9LaDh1WlRsWFF3d3ZSdlNzZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52d413b6-bfe0-452d-addf-d158e69374b7", "record_id": "flaws_cloudtrail:0000080:52d413b6-bfe0-452d-addf-d158e69374b7", "row_index": 80, "timestamp": "2019-03-26T00:04:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52d413b6-bfe0-452d-addf-d158e69374b7", "eventTime": "2019-03-26T00:04:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5Mzl5cUhQdllTalE4Y0Y4d0FJc3FXSnVZa2xqczB5QlNlUmlVeXMwbjdRQ3pLZlV4WklReWEvMGxBYlpISEF4a1A5L3JwelRybENOeTl6UDJ0OXQweWphWkZYdkYwb3Z0bTV1QVRETlRUN3BBcnd5VFNLQWZobVBXZkhiOGcxZmFQNUNhK0twbVcvV2thcEEzbS9xalhKWUpINi9nbFd5THY0K3FkTWY4a0RTZkJ0bmljYy96dGxKNVVEUE9LaDh1WlRsWFF3d3ZSdlNzZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6b2d85d-eab6-4754-8101-4077cfe64503", "record_id": "flaws_cloudtrail:0000081:d6b2d85d-eab6-4754-8101-4077cfe64503", "row_index": 81, "timestamp": "2019-03-26T00:04:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6b2d85d-eab6-4754-8101-4077cfe64503", "eventTime": "2019-03-26T00:04:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5VlM5K3VoeUVIays4SU9ySitOWkZSVmNXcUladUY3SnplbytwaDI1MWt4VlA4U3M5cXNvUEVxTlJZdENrNjVpbTRiWmcybUZwUFp2WEJXbFI1Z3F0WStkRS9BcS92ZkluZjlSRkZRWXh1SDdTUnZzQkMraDdOVS90eitMT3hPYWcrTVYvU0lvb29iTm9hQS9SV1h4a2NQMlkvZHlrdlRGR21tMlR0VDZ4cWUwN1dKRXF1eWZtSVZZL1d5YXU2d0ROa3RMa1gvRW5ZN0hFdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6b2d85d-eab6-4754-8101-4077cfe64503", "record_id": "flaws_cloudtrail:0000082:d6b2d85d-eab6-4754-8101-4077cfe64503", "row_index": 82, "timestamp": "2019-03-26T00:04:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6b2d85d-eab6-4754-8101-4077cfe64503", "eventTime": "2019-03-26T00:04:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5VlM5K3VoeUVIays4SU9ySitOWkZSVmNXcUladUY3SnplbytwaDI1MWt4VlA4U3M5cXNvUEVxTlJZdENrNjVpbTRiWmcybUZwUFp2WEJXbFI1Z3F0WStkRS9BcS92ZkluZjlSRkZRWXh1SDdTUnZzQkMraDdOVS90eitMT3hPYWcrTVYvU0lvb29iTm9hQS9SV1h4a2NQMlkvZHlrdlRGR21tMlR0VDZ4cWUwN1dKRXF1eWZtSVZZL1d5YXU2d0ROa3RMa1gvRW5ZN0hFdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b29efef-5942-469d-aecb-c437746ee1a3", "record_id": "flaws_cloudtrail:0000083:7b29efef-5942-469d-aecb-c437746ee1a3", "row_index": 83, "timestamp": "2019-03-26T00:04:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b29efef-5942-469d-aecb-c437746ee1a3", "eventTime": "2019-03-26T00:04:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiUlpzRCtYc0F0UjVUUHJMbGhVUVdicVJFT0lMUksram8xTE9lT2s5NUlSZkVnRlhXYXN0RnBCUm1iUDN3aG1VRU8zQTNxdUhwZ2UwUTBkaHpVUUJzV0tTcEdOdGpmcEhoV0dGOVVGMlJBeXlBTHRTdlNMZGljeUpoWlJ3dXhuZXBHSi9GMXRDcnJteHplUXk4b0JneFlMNFVGUlFYR1duMHFIUCtFVDhZRlY2dkVzY05xM0cybEd5bHRqdEZOaXF2NTZaSjgrbitQMldqQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b29efef-5942-469d-aecb-c437746ee1a3", "record_id": "flaws_cloudtrail:0000084:7b29efef-5942-469d-aecb-c437746ee1a3", "row_index": 84, "timestamp": "2019-03-26T00:04:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b29efef-5942-469d-aecb-c437746ee1a3", "eventTime": "2019-03-26T00:04:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiUlpzRCtYc0F0UjVUUHJMbGhVUVdicVJFT0lMUksram8xTE9lT2s5NUlSZkVnRlhXYXN0RnBCUm1iUDN3aG1VRU8zQTNxdUhwZ2UwUTBkaHpVUUJzV0tTcEdOdGpmcEhoV0dGOVVGMlJBeXlBTHRTdlNMZGljeUpoWlJ3dXhuZXBHSi9GMXRDcnJteHplUXk4b0JneFlMNFVGUlFYR1duMHFIUCtFVDhZRlY2dkVzY05xM0cybEd5bHRqdEZOaXF2NTZaSjgrbitQMldqQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "612a7541-d68e-4c5d-9e91-bfc47144d89", "record_id": "flaws_cloudtrail:0000085:612a7541-d68e-4c5d-9e91-bfc47144d89", "row_index": 85, "timestamp": "2019-03-26T00:04:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "612a7541-d68e-4c5d-9e91-bfc47144d89", "eventTime": "2019-03-26T00:04:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZbHdGZ3p0R1NRdVNUQzA1NUpzZ0N1cDIxajE2bzZWRVdnVjMzTXViUEYxdndRbDlnc3N2SWlBNDdNa2RJeW9XZHNXNFdrclhLVHRqdDVCMmg2ZFViM211bE1va3lJSVFNVkNHcFpNbTlxOTNBYnlsYzg5aU5DeEVaRHFIT2ZDdkxKQ0IvWGNqUnVaRHUrQTVMbU5Bbk9HcWV3K2c2Q2laVUpzU3NxeEMzbG5xS3E4QlQ2TGQ3WkZ3WG1oRlBJNE5sc2JMWGxWZWY1bzcrZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "612a7541-d68e-4c5d-9e91-bfc47144d89", "record_id": "flaws_cloudtrail:0000086:612a7541-d68e-4c5d-9e91-bfc47144d89", "row_index": 86, "timestamp": "2019-03-26T00:04:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "612a7541-d68e-4c5d-9e91-bfc47144d89", "eventTime": "2019-03-26T00:04:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZbHdGZ3p0R1NRdVNUQzA1NUpzZ0N1cDIxajE2bzZWRVdnVjMzTXViUEYxdndRbDlnc3N2SWlBNDdNa2RJeW9XZHNXNFdrclhLVHRqdDVCMmg2ZFViM211bE1va3lJSVFNVkNHcFpNbTlxOTNBYnlsYzg5aU5DeEVaRHFIT2ZDdkxKQ0IvWGNqUnVaRHUrQTVMbU5Bbk9HcWV3K2c2Q2laVUpzU3NxeEMzbG5xS3E4QlQ2TGQ3WkZ3WG1oRlBJNE5sc2JMWGxWZWY1bzcrZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65f4b643-4ef8-44ab-9981-990964f12781", "record_id": "flaws_cloudtrail:0000087:65f4b643-4ef8-44ab-9981-990964f12781", "row_index": 87, "timestamp": "2019-03-26T00:04:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65f4b643-4ef8-44ab-9981-990964f12781", "eventTime": "2019-03-26T00:04:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnVWVhVm1MUm1hbGIxVEZkVlJPaThJUzIwNzYzbkdhR0dMT3lMaUZmZlF0bmdTcHphdllmc2pkSks3ZjdPaEkvRFNMNDlPRzVrQkpxWDJpL3BFUFpmT2NLVEk2bGR6N2dJQjVPUlJiUlQvMXozY0pjMEhZVVlsaGxKTlJWdytDK1NSQkQwaVdpRXRvK0xJY3ljWkYvUGg0cno3ZExiMmJlTEdPbk5DTm1rZ1c0d0pMa0JVVlphaCtVeFMxejlVVjJmb0tkV0lMUVpQWTlPdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65f4b643-4ef8-44ab-9981-990964f12781", "record_id": "flaws_cloudtrail:0000088:65f4b643-4ef8-44ab-9981-990964f12781", "row_index": 88, "timestamp": "2019-03-26T00:04:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65f4b643-4ef8-44ab-9981-990964f12781", "eventTime": "2019-03-26T00:04:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnVWVhVm1MUm1hbGIxVEZkVlJPaThJUzIwNzYzbkdhR0dMT3lMaUZmZlF0bmdTcHphdllmc2pkSks3ZjdPaEkvRFNMNDlPRzVrQkpxWDJpL3BFUFpmT2NLVEk2bGR6N2dJQjVPUlJiUlQvMXozY0pjMEhZVVlsaGxKTlJWdytDK1NSQkQwaVdpRXRvK0xJY3ljWkYvUGg0cno3ZExiMmJlTEdPbk5DTm1rZ1c0d0pMa0JVVlphaCtVeFMxejlVVjJmb0tkV0lMUVpQWTlPdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdc8734f-5fa6-4769-b4fb-5db9c8a64d5a", "record_id": "flaws_cloudtrail:0000089:fdc8734f-5fa6-4769-b4fb-5db9c8a64d5a", "row_index": 89, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdc8734f-5fa6-4769-b4fb-5db9c8a64d5a", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzVEVKV2xXUldjOEQ5L0lvejJwQUozNlhoYWIwUWcxeVVMYytSK2tHazNqMDcwRjJMZjNNeGdBazRNVzVuSGMwRHliVzBYR1Fzd2hzMnprd0luTmJ1R0N4eCtZSUZpVkNsK2xSL2pmejFjdWgvMlRBemRYaHYwSHZpOVBLeFpkTkxaYnNuWXExamx3WDJDSjIrdXR1RHJ4RHNUcXVza3N3Znd3R2NWT0RPWkg0cm1raGc4cWRvS1RGTXQ0M3hIUmtPVXUrRS9jUDRkeEZGNEhtODU5OGNSTFNRNTEwOUY4PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8ed5763-ca05-4356-8c83-ecad291d99c1", "record_id": "flaws_cloudtrail:0000090:e8ed5763-ca05-4356-8c83-ecad291d99c1", "row_index": 90, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8ed5763-ca05-4356-8c83-ecad291d99c1", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJyUEs5LzhLTm92dnQyd1RBYkZwcCs2bUsrUzl2TzkyQjI3NXRnV1k0ZWZuTlZlbTRtVFpHNDdSTG5SMFVLenBQWGtITk55VVBsdnl2YVNTL05LZFprRit1R0V3dTJva3JaWTYvaXJGUmgzYithSGFLRGQ3RkxUL0dub2g0UWo4MStPVitlYnRSMSsyTXpMWXE3TEh6Y3EzOEdsTU1wSUhoUCtKRVNERzk2Z1g1RzMxSHZjaXhjdjBkUDJtVmlFaGpuT2dYaTFvODhMbnZKcW45aElBOG94MXVKbVRlM040PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6724ebe3-5ba1-48d5-9493-24b8e3394fee", "record_id": "flaws_cloudtrail:0000091:6724ebe3-5ba1-48d5-9493-24b8e3394fee", "row_index": 91, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6724ebe3-5ba1-48d5-9493-24b8e3394fee", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJvZUo0WExINTQzMEZESGRJQkp0M3R1WXFhWTVsOEtVOXN5Qk1rMHp3WFBiYUVKMjdiTGVnZUNPMC9CSzdKM01MOXptSTJKeUIxUVhVK2NGdGhHaTMvQzdWM0c5UmxHVWhOVmgyUjg0YllIZFRVakF3dlJoQ085M2JmTTBYS1QyQlhOSEs3RkRhS1RhTHRla1dPZjR0em1vSVRKRTFPdTNmUCtLR2FDWldsalM4bTFaUVNwQVFFeTlUR243UFFMOHNyMHF6eVJTb0dIYmFWUC85MVFxcXNMMkpHL0d5eGpJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdc2409c-6b57-4467-9670-b36a37382ee4", "record_id": "flaws_cloudtrail:0000092:fdc2409c-6b57-4467-9670-b36a37382ee4", "row_index": 92, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdc2409c-6b57-4467-9670-b36a37382ee4", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjUk5hK2diUjNDTFd6RTYvT3owaC9Sd1ZrMlh3U2FyendiVU5oY3l5TjE5UWdVMU5ZdXBuZDI5L2d4R210UHpqTWU4NEZja0IwV3hSK0VBRE1nS3JEMUxIR0J4T1BPVy9BUGt5YlM1Rmg3ck9MdVV6UnZLdzg2T25SVjJxcEN5YmliVXdRVXdVZWpZaWhPc3BFTG1MN3VrUmZRckwzUTRMMVhFMlhDRDIybkw1OW1hTmMyRmRyaFRXWkhaa2lHR0h4RVpzajU4SE5nPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdc8734f-5fa6-4769-b4fb-5db9c8a64d5a", "record_id": "flaws_cloudtrail:0000093:fdc8734f-5fa6-4769-b4fb-5db9c8a64d5a", "row_index": 93, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdc8734f-5fa6-4769-b4fb-5db9c8a64d5a", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzVEVKV2xXUldjOEQ5L0lvejJwQUozNlhoYWIwUWcxeVVMYytSK2tHazNqMDcwRjJMZjNNeGdBazRNVzVuSGMwRHliVzBYR1Fzd2hzMnprd0luTmJ1R0N4eCtZSUZpVkNsK2xSL2pmejFjdWgvMlRBemRYaHYwSHZpOVBLeFpkTkxaYnNuWXExamx3WDJDSjIrdXR1RHJ4RHNUcXVza3N3Znd3R2NWT0RPWkg0cm1raGc4cWRvS1RGTXQ0M3hIUmtPVXUrRS9jUDRkeEZGNEhtODU5OGNSTFNRNTEwOUY4PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8ed5763-ca05-4356-8c83-ecad291d99c1", "record_id": "flaws_cloudtrail:0000094:e8ed5763-ca05-4356-8c83-ecad291d99c1", "row_index": 94, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8ed5763-ca05-4356-8c83-ecad291d99c1", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJyUEs5LzhLTm92dnQyd1RBYkZwcCs2bUsrUzl2TzkyQjI3NXRnV1k0ZWZuTlZlbTRtVFpHNDdSTG5SMFVLenBQWGtITk55VVBsdnl2YVNTL05LZFprRit1R0V3dTJva3JaWTYvaXJGUmgzYithSGFLRGQ3RkxUL0dub2g0UWo4MStPVitlYnRSMSsyTXpMWXE3TEh6Y3EzOEdsTU1wSUhoUCtKRVNERzk2Z1g1RzMxSHZjaXhjdjBkUDJtVmlFaGpuT2dYaTFvODhMbnZKcW45aElBOG94MXVKbVRlM040PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6724ebe3-5ba1-48d5-9493-24b8e3394fee", "record_id": "flaws_cloudtrail:0000095:6724ebe3-5ba1-48d5-9493-24b8e3394fee", "row_index": 95, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6724ebe3-5ba1-48d5-9493-24b8e3394fee", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJvZUo0WExINTQzMEZESGRJQkp0M3R1WXFhWTVsOEtVOXN5Qk1rMHp3WFBiYUVKMjdiTGVnZUNPMC9CSzdKM01MOXptSTJKeUIxUVhVK2NGdGhHaTMvQzdWM0c5UmxHVWhOVmgyUjg0YllIZFRVakF3dlJoQ085M2JmTTBYS1QyQlhOSEs3RkRhS1RhTHRla1dPZjR0em1vSVRKRTFPdTNmUCtLR2FDWldsalM4bTFaUVNwQVFFeTlUR243UFFMOHNyMHF6eVJTb0dIYmFWUC85MVFxcXNMMkpHL0d5eGpJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdc2409c-6b57-4467-9670-b36a37382ee4", "record_id": "flaws_cloudtrail:0000096:fdc2409c-6b57-4467-9670-b36a37382ee4", "row_index": 96, "timestamp": "2019-03-26T00:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdc2409c-6b57-4467-9670-b36a37382ee4", "eventTime": "2019-03-26T00:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjUk5hK2diUjNDTFd6RTYvT3owaC9Sd1ZrMlh3U2FyendiVU5oY3l5TjE5UWdVMU5ZdXBuZDI5L2d4R210UHpqTWU4NEZja0IwV3hSK0VBRE1nS3JEMUxIR0J4T1BPVy9BUGt5YlM1Rmg3ck9MdVV6UnZLdzg2T25SVjJxcEN5YmliVXdRVXdVZWpZaWhPc3BFTG1MN3VrUmZRckwzUTRMMVhFMlhDRDIybkw1OW1hTmMyRmRyaFRXWkhaa2lHR0h4RVpzajU4SE5nPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12d4f19a-b844-47e3-b0f9-107103ed3594b", "record_id": "flaws_cloudtrail:0000097:12d4f19a-b844-47e3-b0f9-107103ed3594b", "row_index": 97, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12d4f19a-b844-47e3-b0f9-107103ed3594b", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxck1aazl3eDFEbVlhY0lRYlYwQTJwMjhOSmJ4MWlUUHU1TGVQMHNJRlphcWlzTHlUdGc0N1lkOVpwb3RtWUR2Z0o2dEtWc0FCSTIvczhXR1lUVEZ2cEo0Q1U5RHcvSDRXYnBudHpyUk5VcHpBUnk5QXpuYWJzV01zbXd0d2VtcFVmL1FDWWkyeEZaVHRtOWE5S3lzRjJ3ei9RSzYwTlN3ZVhPdENYZ054MFRFSkluRlcxSVZxaTBBQXA2MkJ1cWRreno4SDFvbU9UTlp4NWxNQmtjd0d0WDRzekJOLzF3PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cf1fcef-8c24-460a-a9e4-4cfd87332f", "record_id": "flaws_cloudtrail:0000098:9cf1fcef-8c24-460a-a9e4-4cfd87332f", "row_index": 98, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cf1fcef-8c24-460a-a9e4-4cfd87332f", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDamlKeU5VTjdCcS9BS3BiWk1qWHhUeTQ0Y0RrajJ4MmZUQmFmYTBJS3ZEMFAwc0F6cmJaRGZGdFM5Z2xZTDFQendVYUtFNWtLU0VQbklHV3lueW5GR3dHck4ybENtYW1HQ1hUM1E3UzBLL3hlUVJYN3dMbGsvWWloQXNPTzVQcUNwdWVqMXRPYVRUMlR6dHBqMS9wMmxZbGpNdWdQc09uRGtIYzc1VHQzajlQRUtFUWNQa2dPV2RMOFpwenVTaVdOZ244V1JmdkJMdCtkOHFXV3RRK0xRN281d2J1cko0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "baacacaa-6612-4464-9f8e-c41d6e221bb2", "record_id": "flaws_cloudtrail:0000099:baacacaa-6612-4464-9f8e-c41d6e221bb2", "row_index": 99, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "baacacaa-6612-4464-9f8e-c41d6e221bb2", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCMkZCbjZGWkRoLzdFQ285aUdCUC96L3JKbzUxbS9FVlVVWTZ3L3ppekREbFJwOVBCcks4TnNQV1FtSVA1SjdVbTZTQ0FmQ2FpVmZmUkJRYnFzd2c0d3dvdDcxYjFCZm9tTVNrZlNmeFNXTTZEVWtnMitQUmJvZ1l2bXhCNXBkWGtaVWdsUXV2aHRsRWVKd0VvTGhpT0o1czNIQnJ1R3dVci9jeFBHajlEUndyS1VvMG1WKy81MU9CSlNQYnVpeDZaNjJ1d2E2OXN4MDI0cC9FYnlqTVROVTNNbWlvN0pjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "50a3518d-de75-4c8d-9b2b-521cfe5f8235", "record_id": "flaws_cloudtrail:0000100:50a3518d-de75-4c8d-9b2b-521cfe5f8235", "row_index": 100, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "50a3518d-de75-4c8d-9b2b-521cfe5f8235", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIMzdKUm8zQWEvZk9tZEczTi9wR0xDVGxienN4L3J1bFpGdWt0RHl0MXMydTExZlBNaUNxSDFXVU00V3pFS2VXblQ1ZWxFcGVQZEJJL2pKMlk5Y29HZXVmZTZoMHB4cWNWVkl0V2F0ZG1Ba04zOWFqVVZiYzdkVmRmUVk5MlRaSXhWMStBMlduMEVPZ04wUWVleUIvdDVpN2ppbnpWeXJXQzN6S2ZYRTZBSnNTNHV3MXRNU2FuUkQzWXBvZUJzREVjTFZBSjZuYnFSVHFuZXBVOWVoYlp2eFFxbnc1S1NRPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12d4f19a-b844-47e3-b0f9-107103ed3594b", "record_id": "flaws_cloudtrail:0000101:12d4f19a-b844-47e3-b0f9-107103ed3594b", "row_index": 101, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12d4f19a-b844-47e3-b0f9-107103ed3594b", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxck1aazl3eDFEbVlhY0lRYlYwQTJwMjhOSmJ4MWlUUHU1TGVQMHNJRlphcWlzTHlUdGc0N1lkOVpwb3RtWUR2Z0o2dEtWc0FCSTIvczhXR1lUVEZ2cEo0Q1U5RHcvSDRXYnBudHpyUk5VcHpBUnk5QXpuYWJzV01zbXd0d2VtcFVmL1FDWWkyeEZaVHRtOWE5S3lzRjJ3ei9RSzYwTlN3ZVhPdENYZ054MFRFSkluRlcxSVZxaTBBQXA2MkJ1cWRreno4SDFvbU9UTlp4NWxNQmtjd0d0WDRzekJOLzF3PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cf1fcef-8c24-460a-a9e4-4cfd87332f", "record_id": "flaws_cloudtrail:0000102:9cf1fcef-8c24-460a-a9e4-4cfd87332f", "row_index": 102, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cf1fcef-8c24-460a-a9e4-4cfd87332f", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDamlKeU5VTjdCcS9BS3BiWk1qWHhUeTQ0Y0RrajJ4MmZUQmFmYTBJS3ZEMFAwc0F6cmJaRGZGdFM5Z2xZTDFQendVYUtFNWtLU0VQbklHV3lueW5GR3dHck4ybENtYW1HQ1hUM1E3UzBLL3hlUVJYN3dMbGsvWWloQXNPTzVQcUNwdWVqMXRPYVRUMlR6dHBqMS9wMmxZbGpNdWdQc09uRGtIYzc1VHQzajlQRUtFUWNQa2dPV2RMOFpwenVTaVdOZ244V1JmdkJMdCtkOHFXV3RRK0xRN281d2J1cko0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "baacacaa-6612-4464-9f8e-c41d6e221bb2", "record_id": "flaws_cloudtrail:0000103:baacacaa-6612-4464-9f8e-c41d6e221bb2", "row_index": 103, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "baacacaa-6612-4464-9f8e-c41d6e221bb2", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCMkZCbjZGWkRoLzdFQ285aUdCUC96L3JKbzUxbS9FVlVVWTZ3L3ppekREbFJwOVBCcks4TnNQV1FtSVA1SjdVbTZTQ0FmQ2FpVmZmUkJRYnFzd2c0d3dvdDcxYjFCZm9tTVNrZlNmeFNXTTZEVWtnMitQUmJvZ1l2bXhCNXBkWGtaVWdsUXV2aHRsRWVKd0VvTGhpT0o1czNIQnJ1R3dVci9jeFBHajlEUndyS1VvMG1WKy81MU9CSlNQYnVpeDZaNjJ1d2E2OXN4MDI0cC9FYnlqTVROVTNNbWlvN0pjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "50a3518d-de75-4c8d-9b2b-521cfe5f8235", "record_id": "flaws_cloudtrail:0000104:50a3518d-de75-4c8d-9b2b-521cfe5f8235", "row_index": 104, "timestamp": "2019-03-26T00:04:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "50a3518d-de75-4c8d-9b2b-521cfe5f8235", "eventTime": "2019-03-26T00:04:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIMzdKUm8zQWEvZk9tZEczTi9wR0xDVGxienN4L3J1bFpGdWt0RHl0MXMydTExZlBNaUNxSDFXVU00V3pFS2VXblQ1ZWxFcGVQZEJJL2pKMlk5Y29HZXVmZTZoMHB4cWNWVkl0V2F0ZG1Ba04zOWFqVVZiYzdkVmRmUVk5MlRaSXhWMStBMlduMEVPZ04wUWVleUIvdDVpN2ppbnpWeXJXQzN6S2ZYRTZBSnNTNHV3MXRNU2FuUkQzWXBvZUJzREVjTFZBSjZuYnFSVHFuZXBVOWVoYlp2eFFxbnc1S1NRPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01dc9e17-f40c-4145-af2a-070f823738d4", "record_id": "flaws_cloudtrail:0000105:01dc9e17-f40c-4145-af2a-070f823738d4", "row_index": 105, "timestamp": "2019-03-26T00:07:10Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01dc9e17-f40c-4145-af2a-070f823738d4", "eventTime": "2019-03-26T00:07:10Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01dc9e17-f40c-4145-af2a-070f823738d4", "record_id": "flaws_cloudtrail:0000106:01dc9e17-f40c-4145-af2a-070f823738d4", "row_index": 106, "timestamp": "2019-03-26T00:07:10Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01dc9e17-f40c-4145-af2a-070f823738d4", "eventTime": "2019-03-26T00:07:10Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53fa21b2-399b-4e9e-86a7-d0c4435c3cad", "record_id": "flaws_cloudtrail:0000107:53fa21b2-399b-4e9e-86a7-d0c4435c3cad", "row_index": 107, "timestamp": "2019-03-26T00:12:12Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53fa21b2-399b-4e9e-86a7-d0c4435c3cad", "eventTime": "2019-03-26T00:12:12Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53fa21b2-399b-4e9e-86a7-d0c4435c3cad", "record_id": "flaws_cloudtrail:0000108:53fa21b2-399b-4e9e-86a7-d0c4435c3cad", "row_index": 108, "timestamp": "2019-03-26T00:12:12Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53fa21b2-399b-4e9e-86a7-d0c4435c3cad", "eventTime": "2019-03-26T00:12:12Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56dd5d70-bac3-4ab5-af24-091c97af1acb", "record_id": "flaws_cloudtrail:0000109:56dd5d70-bac3-4ab5-af24-091c97af1acb", "row_index": 109, "timestamp": "2019-03-26T00:12:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56dd5d70-bac3-4ab5-af24-091c97af1acb", "eventTime": "2019-03-26T00:12:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56dd5d70-bac3-4ab5-af24-091c97af1acb", "record_id": "flaws_cloudtrail:0000110:56dd5d70-bac3-4ab5-af24-091c97af1acb", "row_index": 110, "timestamp": "2019-03-26T00:12:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56dd5d70-bac3-4ab5-af24-091c97af1acb", "eventTime": "2019-03-26T00:12:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f20e279-dff4-4e1c-96fa-dda0a64c240e", "record_id": "flaws_cloudtrail:0000111:1f20e279-dff4-4e1c-96fa-dda0a64c240e", "row_index": 111, "timestamp": "2019-03-26T00:13:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f20e279-dff4-4e1c-96fa-dda0a64c240e", "eventTime": "2019-03-26T00:13:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f20e279-dff4-4e1c-96fa-dda0a64c240e", "record_id": "flaws_cloudtrail:0000112:1f20e279-dff4-4e1c-96fa-dda0a64c240e", "row_index": 112, "timestamp": "2019-03-26T00:13:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f20e279-dff4-4e1c-96fa-dda0a64c240e", "eventTime": "2019-03-26T00:13:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3296b99d-62d4-489a-a9d1-3a4b57ac0eb7", "record_id": "flaws_cloudtrail:0000113:3296b99d-62d4-489a-a9d1-3a4b57ac0eb7", "row_index": 113, "timestamp": "2019-03-26T00:13:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3296b99d-62d4-489a-a9d1-3a4b57ac0eb7", "eventTime": "2019-03-26T00:13:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEMy9PQ0wxV1NzeTR5Nm5GKzF0TUxrNnlGWWxmdnd1SFhPMWdnbDUxUGp3ZGZJZW9vM3hXU3dvRkVEY2RobFBxbTA5K0FaeFo1N2FoTUFkaCtSeGg5ZHVPRTYwL05FU2FwUHNaL0dxMmZFWjRFNWxxOUlVZVE0ekZZRVNQa1BUUCswVWN0SjUraWYrME1Oc3RMWlVvYzh2NDZkeHBBNU9oQnZtS3pycUxiTGdUQ1pnUytZdGY2dHRXeUNPRFV4RUhFOWt6Ty8xNEYwYUNGQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3296b99d-62d4-489a-a9d1-3a4b57ac0eb7", "record_id": "flaws_cloudtrail:0000114:3296b99d-62d4-489a-a9d1-3a4b57ac0eb7", "row_index": 114, "timestamp": "2019-03-26T00:13:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3296b99d-62d4-489a-a9d1-3a4b57ac0eb7", "eventTime": "2019-03-26T00:13:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEMy9PQ0wxV1NzeTR5Nm5GKzF0TUxrNnlGWWxmdnd1SFhPMWdnbDUxUGp3ZGZJZW9vM3hXU3dvRkVEY2RobFBxbTA5K0FaeFo1N2FoTUFkaCtSeGg5ZHVPRTYwL05FU2FwUHNaL0dxMmZFWjRFNWxxOUlVZVE0ekZZRVNQa1BUUCswVWN0SjUraWYrME1Oc3RMWlVvYzh2NDZkeHBBNU9oQnZtS3pycUxiTGdUQ1pnUytZdGY2dHRXeUNPRFV4RUhFOWt6Ty8xNEYwYUNGQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7243e248-5553-4439-98cd-bfdeb091724f", "record_id": "flaws_cloudtrail:0000115:7243e248-5553-4439-98cd-bfdeb091724f", "row_index": 115, "timestamp": "2019-03-26T00:13:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7243e248-5553-4439-98cd-bfdeb091724f", "eventTime": "2019-03-26T00:13:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNWGRpUGVHTjFaUzBLU2djTjE2bk1xcjd3a1A1ZVg2Myt1NlFtV1BSUmkzMkg4ZUd4WEhMbjNRaUFJVjdDVWxOeFc0ekcvSDV0YWhMTjJuZlN3aHJlZElTbEMvS2pPWTNaWGRVaGlRTStYRE5vc1dndUNZeGhtK3FEY2JnSjQxRlE2WWJsRHdRYml5cThDc2dGTko3bWlCUE1OS05FMnEza054ckdTT2hRcjQwVkhlVURqN0F4T2Z2aTVDN0hLbzdGK1JSNzF0aTZlY3piQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7243e248-5553-4439-98cd-bfdeb091724f", "record_id": "flaws_cloudtrail:0000116:7243e248-5553-4439-98cd-bfdeb091724f", "row_index": 116, "timestamp": "2019-03-26T00:13:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7243e248-5553-4439-98cd-bfdeb091724f", "eventTime": "2019-03-26T00:13:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNWGRpUGVHTjFaUzBLU2djTjE2bk1xcjd3a1A1ZVg2Myt1NlFtV1BSUmkzMkg4ZUd4WEhMbjNRaUFJVjdDVWxOeFc0ekcvSDV0YWhMTjJuZlN3aHJlZElTbEMvS2pPWTNaWGRVaGlRTStYRE5vc1dndUNZeGhtK3FEY2JnSjQxRlE2WWJsRHdRYml5cThDc2dGTko3bWlCUE1OS05FMnEza054ckdTT2hRcjQwVkhlVURqN0F4T2Z2aTVDN0hLbzdGK1JSNzF0aTZlY3piQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41cc48fb-bcaf-421f-be1b-ce095a49612c", "record_id": "flaws_cloudtrail:0000117:41cc48fb-bcaf-421f-be1b-ce095a49612c", "row_index": 117, "timestamp": "2019-03-26T00:13:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41cc48fb-bcaf-421f-be1b-ce095a49612c", "eventTime": "2019-03-26T00:13:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzKytMMlIrS3VVTUJqaHlCcTlRd2xLRFFyaVZMS1ViMjJRUnA3VUphazB1aFNTVExaMEpzSjVKbGpia293VnlGR0ozY1JDU3FHZnB1eS91RXlmNkY5SHI2VWMxMnlGS21rSkJEeHRaYVhRb2IrY2ZJeVh2bWh3cUdjbE4vWjNNM0xIanFpMnE4R2N4RlhWMjdQeWVkVDEyWkp2MCtPeGxQZXVQS01yWTFvdmJHcmFZbHFqMnU3cHFEK1RHN0x0SjFZZkVvci9YekdnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41cc48fb-bcaf-421f-be1b-ce095a49612c", "record_id": "flaws_cloudtrail:0000118:41cc48fb-bcaf-421f-be1b-ce095a49612c", "row_index": 118, "timestamp": "2019-03-26T00:13:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41cc48fb-bcaf-421f-be1b-ce095a49612c", "eventTime": "2019-03-26T00:13:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzKytMMlIrS3VVTUJqaHlCcTlRd2xLRFFyaVZMS1ViMjJRUnA3VUphazB1aFNTVExaMEpzSjVKbGpia293VnlGR0ozY1JDU3FHZnB1eS91RXlmNkY5SHI2VWMxMnlGS21rSkJEeHRaYVhRb2IrY2ZJeVh2bWh3cUdjbE4vWjNNM0xIanFpMnE4R2N4RlhWMjdQeWVkVDEyWkp2MCtPeGxQZXVQS01yWTFvdmJHcmFZbHFqMnU3cHFEK1RHN0x0SjFZZkVvci9YekdnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcb6c14c-0503-41ac-a27f-2992eee69042", "record_id": "flaws_cloudtrail:0000119:bcb6c14c-0503-41ac-a27f-2992eee69042", "row_index": 119, "timestamp": "2019-03-26T00:13:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcb6c14c-0503-41ac-a27f-2992eee69042", "eventTime": "2019-03-26T00:13:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBR0MxMEFvK21jYk5lOVFFenlwVkRYV0xEUXByTzdJaUViN1h2Z0t1YUpaRE9ldURUZmZPYW05YmZJakJTQ1R3dHpxZ0VmczBTTDBaNjZzTDh4SEd4Rm1ydDR0UzFuVGhDYzlQTFF1TTFlalJJT0xMMXZiV0hqQVMxK21jZmQvaTVvcGdLVjZDb3hPNnBRUEJLS014b1h1d0I4SlpyS2l5RmRTNExzSFJGUlhxNzZmRWc5VG5SOStJOFE4enljUytNTjczZmpzSmk4VkhyZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcb6c14c-0503-41ac-a27f-2992eee69042", "record_id": "flaws_cloudtrail:0000120:bcb6c14c-0503-41ac-a27f-2992eee69042", "row_index": 120, "timestamp": "2019-03-26T00:13:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcb6c14c-0503-41ac-a27f-2992eee69042", "eventTime": "2019-03-26T00:13:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBR0MxMEFvK21jYk5lOVFFenlwVkRYV0xEUXByTzdJaUViN1h2Z0t1YUpaRE9ldURUZmZPYW05YmZJakJTQ1R3dHpxZ0VmczBTTDBaNjZzTDh4SEd4Rm1ydDR0UzFuVGhDYzlQTFF1TTFlalJJT0xMMXZiV0hqQVMxK21jZmQvaTVvcGdLVjZDb3hPNnBRUEJLS014b1h1d0I4SlpyS2l5RmRTNExzSFJGUlhxNzZmRWc5VG5SOStJOFE4enljUytNTjczZmpzSmk4VkhyZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6077eda7-d48b-4d33-9559-126c1267cb0e", "record_id": "flaws_cloudtrail:0000121:6077eda7-d48b-4d33-9559-126c1267cb0e", "row_index": 121, "timestamp": "2019-03-26T00:13:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6077eda7-d48b-4d33-9559-126c1267cb0e", "eventTime": "2019-03-26T00:13:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5bW9LbFY4ZHVmQ1FBY256ZlZDRTBtemNPZTBZNDl5aXdwdFJ0aE9WUElBS2tSRXFENjNENUtld1h5SDc2aGFwSEFqTE5yNmE0TzY1Mld6QnkydEJUQThKTTBlWU5admhsaTliZWl4UE5ESnpIRkkvWTBaN0Y3dk00OVc5eU1OSHdrdTUwcU5EcU14d0tneGUrVVJaODEwc21LR2hMQUFVUk91ejNtRFBhVDhKTE11Y01sTXlpenVic1NmZ1ArRUVTYVRNN28zQTVBdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6077eda7-d48b-4d33-9559-126c1267cb0e", "record_id": "flaws_cloudtrail:0000122:6077eda7-d48b-4d33-9559-126c1267cb0e", "row_index": 122, "timestamp": "2019-03-26T00:13:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6077eda7-d48b-4d33-9559-126c1267cb0e", "eventTime": "2019-03-26T00:13:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5bW9LbFY4ZHVmQ1FBY256ZlZDRTBtemNPZTBZNDl5aXdwdFJ0aE9WUElBS2tSRXFENjNENUtld1h5SDc2aGFwSEFqTE5yNmE0TzY1Mld6QnkydEJUQThKTTBlWU5admhsaTliZWl4UE5ESnpIRkkvWTBaN0Y3dk00OVc5eU1OSHdrdTUwcU5EcU14d0tneGUrVVJaODEwc21LR2hMQUFVUk91ejNtRFBhVDhKTE11Y01sTXlpenVic1NmZ1ArRUVTYVRNN28zQTVBdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a6d4613-09f0-42d8-aa66-3fb188cfc3c4", "record_id": "flaws_cloudtrail:0000123:3a6d4613-09f0-42d8-aa66-3fb188cfc3c4", "row_index": 123, "timestamp": "2019-03-26T00:13:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a6d4613-09f0-42d8-aa66-3fb188cfc3c4", "eventTime": "2019-03-26T00:13:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0aCsrTE9RTkVBNTR0RWZ5dVZ2UzBOVFRObTBEUU80N1kvVWhCWVpQQkNWVlRwV0tBVWFCRFZ4RnZIcXBtZWE0amlaTTNKY0FiNUpHYzRzdDZ3V1BuMVFsaDVvamliS2VGVEZ6MHAwV25DMCtQQjlsV0VwWXIxRmZnNmVKTCs5d0tNYXlaS0hZWkw5OG9hUUJHY1pJSEorT3FiWWZmdXpLelBEbThaTWVSRG1ZYjUxRnZMajFLd0hVc3hiQlp5bVhFY2gycW0zUVhIemNWdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a6d4613-09f0-42d8-aa66-3fb188cfc3c4", "record_id": "flaws_cloudtrail:0000124:3a6d4613-09f0-42d8-aa66-3fb188cfc3c4", "row_index": 124, "timestamp": "2019-03-26T00:13:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a6d4613-09f0-42d8-aa66-3fb188cfc3c4", "eventTime": "2019-03-26T00:13:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0aCsrTE9RTkVBNTR0RWZ5dVZ2UzBOVFRObTBEUU80N1kvVWhCWVpQQkNWVlRwV0tBVWFCRFZ4RnZIcXBtZWE0amlaTTNKY0FiNUpHYzRzdDZ3V1BuMVFsaDVvamliS2VGVEZ6MHAwV25DMCtQQjlsV0VwWXIxRmZnNmVKTCs5d0tNYXlaS0hZWkw5OG9hUUJHY1pJSEorT3FiWWZmdXpLelBEbThaTWVSRG1ZYjUxRnZMajFLd0hVc3hiQlp5bVhFY2gycW0zUVhIemNWdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2b20112-719f-48d5-b066-54815ef4640", "record_id": "flaws_cloudtrail:0000125:f2b20112-719f-48d5-b066-54815ef4640", "row_index": 125, "timestamp": "2019-03-26T00:13:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2b20112-719f-48d5-b066-54815ef4640", "eventTime": "2019-03-26T00:13:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwYnNtSXEwMlg2UkNwbWRqU012SEVib2JCYjBzTENpOGhNMk1tY29wM1QvN2VMQzBSQmN3WGkwY3JJMmtsRFRnUEVJclpSRTdla3VranplbFJqcndtVmNjRFRIVnVtWlVTYlVwT3QwUno5NnNYUGlrcEdCZDdPN2U4U0Z0S2grZ0RDaFZ3VzBRaTRnWWZPaEpiMk0xdnhTaFA3bWxtdjdkbUNQUWlOSk9RbFdaYnlMUmJObnFBcG40MHBPSG5qMFlqclFubWhFci9jbEpLdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2b20112-719f-48d5-b066-54815ef4640", "record_id": "flaws_cloudtrail:0000126:f2b20112-719f-48d5-b066-54815ef4640", "row_index": 126, "timestamp": "2019-03-26T00:13:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2b20112-719f-48d5-b066-54815ef4640", "eventTime": "2019-03-26T00:13:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwYnNtSXEwMlg2UkNwbWRqU012SEVib2JCYjBzTENpOGhNMk1tY29wM1QvN2VMQzBSQmN3WGkwY3JJMmtsRFRnUEVJclpSRTdla3VranplbFJqcndtVmNjRFRIVnVtWlVTYlVwT3QwUno5NnNYUGlrcEdCZDdPN2U4U0Z0S2grZ0RDaFZ3VzBRaTRnWWZPaEpiMk0xdnhTaFA3bWxtdjdkbUNQUWlOSk9RbFdaYnlMUmJObnFBcG40MHBPSG5qMFlqclFubWhFci9jbEpLdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bae1520a-7fa1-426b-8e9d-cc427082ac04", "record_id": "flaws_cloudtrail:0000127:bae1520a-7fa1-426b-8e9d-cc427082ac04", "row_index": 127, "timestamp": "2019-03-26T00:13:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bae1520a-7fa1-426b-8e9d-cc427082ac04", "eventTime": "2019-03-26T00:13:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKRGNRNis3UmFsa1o3RzNDMG9MdnR5K1lRaDlTQUZZb1d6TmFVZzdQSTZWS2dkcmlxeTBWc2Y5L2IxWGRIZ05kWnpIaFNkYmJ5YTJ4amNaMTBCSU50Z1dqWUMxZXozMmpHd3Z6bVYrYU1CR3N6UEtHZWVSU0hOSmgyNldMTG5YV0trYmdGYXB6d3V1bUVGL2RoSUFvU2o2eWE4bm9Gc0tRL2hUMW9Jc25MTmdnQWhPNlN4V0d6cVdYUEJQdWlIcGR5NmNjNHRzclhkb0VMQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bae1520a-7fa1-426b-8e9d-cc427082ac04", "record_id": "flaws_cloudtrail:0000128:bae1520a-7fa1-426b-8e9d-cc427082ac04", "row_index": 128, "timestamp": "2019-03-26T00:13:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bae1520a-7fa1-426b-8e9d-cc427082ac04", "eventTime": "2019-03-26T00:13:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKRGNRNis3UmFsa1o3RzNDMG9MdnR5K1lRaDlTQUZZb1d6TmFVZzdQSTZWS2dkcmlxeTBWc2Y5L2IxWGRIZ05kWnpIaFNkYmJ5YTJ4amNaMTBCSU50Z1dqWUMxZXozMmpHd3Z6bVYrYU1CR3N6UEtHZWVSU0hOSmgyNldMTG5YV0trYmdGYXB6d3V1bUVGL2RoSUFvU2o2eWE4bm9Gc0tRL2hUMW9Jc25MTmdnQWhPNlN4V0d6cVdYUEJQdWlIcGR5NmNjNHRzclhkb0VMQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "688f8bf7-1c73-41c9-95d0-99bb92cf8df5", "record_id": "flaws_cloudtrail:0000129:688f8bf7-1c73-41c9-95d0-99bb92cf8df5", "row_index": 129, "timestamp": "2019-03-26T00:13:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "688f8bf7-1c73-41c9-95d0-99bb92cf8df5", "eventTime": "2019-03-26T00:13:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4NEJmR2V5VEdTTXZMeU5NNVQyaEk3Q1FLbEU4K2NWN1FsT1J0di9IY3JCUkVSQ1poSHlTbDlKLzlUV1FkUWF5V21WeUxGRTBNYkZhMWlOTytwRGJqOVpyWHMrenlqbGJEeWpHYTVPL0xsT2NubWxFY1VXL3NhV3hCRlNnR3Z3WkV0OFhnK0xhN2VYYllVMFlOdkVySkEweloxZ0ZSd3QvaDZGa1lva3ZNbmxGeWVrcG9pZ1BpdGxlTjNFUTUrUUNRdm9zczJNMmgvakpUdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "688f8bf7-1c73-41c9-95d0-99bb92cf8df5", "record_id": "flaws_cloudtrail:0000130:688f8bf7-1c73-41c9-95d0-99bb92cf8df5", "row_index": 130, "timestamp": "2019-03-26T00:13:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "688f8bf7-1c73-41c9-95d0-99bb92cf8df5", "eventTime": "2019-03-26T00:13:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4NEJmR2V5VEdTTXZMeU5NNVQyaEk3Q1FLbEU4K2NWN1FsT1J0di9IY3JCUkVSQ1poSHlTbDlKLzlUV1FkUWF5V21WeUxGRTBNYkZhMWlOTytwRGJqOVpyWHMrenlqbGJEeWpHYTVPL0xsT2NubWxFY1VXL3NhV3hCRlNnR3Z3WkV0OFhnK0xhN2VYYllVMFlOdkVySkEweloxZ0ZSd3QvaDZGa1lva3ZNbmxGeWVrcG9pZ1BpdGxlTjNFUTUrUUNRdm9zczJNMmgvakpUdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5840af9d-4daa-4eec-97be-408ff74c30dd", "record_id": "flaws_cloudtrail:0000131:5840af9d-4daa-4eec-97be-408ff74c30dd", "row_index": 131, "timestamp": "2019-03-26T00:13:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5840af9d-4daa-4eec-97be-408ff74c30dd", "eventTime": "2019-03-26T00:13:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ1S1VsMDVlekc5MDJPNzdKYVNtbEljd2xad0lYTVF3akFUelUyL2oxbXRRS0d1MnFJVHB0L1A3bjBiTlFnTnhjVjMvNVVkU1pFejQ3WWxHRmFuM3p2d1ZJWllSanlEbGFmSG9kRDk5WmxPZnRhQzNKdUpHV1ZkZjB3ZUVtTktRWVJYYkF5Qld6ZURZdEtGM0ZwaHh3R0hJM3poTkJZZUVCOTdmSXNZVmc1ekFFRURFZ2tVQkdGK3RORzJId2o1TGtEKzVNS2E2TWlwbnRsdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5840af9d-4daa-4eec-97be-408ff74c30dd", "record_id": "flaws_cloudtrail:0000132:5840af9d-4daa-4eec-97be-408ff74c30dd", "row_index": 132, "timestamp": "2019-03-26T00:13:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5840af9d-4daa-4eec-97be-408ff74c30dd", "eventTime": "2019-03-26T00:13:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ1S1VsMDVlekc5MDJPNzdKYVNtbEljd2xad0lYTVF3akFUelUyL2oxbXRRS0d1MnFJVHB0L1A3bjBiTlFnTnhjVjMvNVVkU1pFejQ3WWxHRmFuM3p2d1ZJWllSanlEbGFmSG9kRDk5WmxPZnRhQzNKdUpHV1ZkZjB3ZUVtTktRWVJYYkF5Qld6ZURZdEtGM0ZwaHh3R0hJM3poTkJZZUVCOTdmSXNZVmc1ekFFRURFZ2tVQkdGK3RORzJId2o1TGtEKzVNS2E2TWlwbnRsdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06bfd192-1f6a-4b4d-92f9-480fcae285a8", "record_id": "flaws_cloudtrail:0000133:06bfd192-1f6a-4b4d-92f9-480fcae285a8", "row_index": 133, "timestamp": "2019-03-26T00:13:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06bfd192-1f6a-4b4d-92f9-480fcae285a8", "eventTime": "2019-03-26T00:13:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnQW8rUWRaQStpdzM3akhzOTI1SmwrT3lyOVdpYW9hZURPLzZhR0R1aTI1Y1ZwQWMyMG5LZUZMbk8rTzhtQ3FxcE5tUmVjN0VFd1N5aHlFU2VEZ0o2WFk5aXM5anlIN2VaS1htcXFFd2trM01hV3ZReHAzejJkZXBndmJLTjVrN0N3a3VjNCtaNnNrRzJqLzFDekY5THB5Y3VTVmNtMFZ6OE0vUDVIZ2dUUno5RG9OUUNrRnVMbW9sTkd0dXFRcTEwSWZLN1hOeVhjWVhMdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06bfd192-1f6a-4b4d-92f9-480fcae285a8", "record_id": "flaws_cloudtrail:0000134:06bfd192-1f6a-4b4d-92f9-480fcae285a8", "row_index": 134, "timestamp": "2019-03-26T00:13:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06bfd192-1f6a-4b4d-92f9-480fcae285a8", "eventTime": "2019-03-26T00:13:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnQW8rUWRaQStpdzM3akhzOTI1SmwrT3lyOVdpYW9hZURPLzZhR0R1aTI1Y1ZwQWMyMG5LZUZMbk8rTzhtQ3FxcE5tUmVjN0VFd1N5aHlFU2VEZ0o2WFk5aXM5anlIN2VaS1htcXFFd2trM01hV3ZReHAzejJkZXBndmJLTjVrN0N3a3VjNCtaNnNrRzJqLzFDekY5THB5Y3VTVmNtMFZ6OE0vUDVIZ2dUUno5RG9OUUNrRnVMbW9sTkd0dXFRcTEwSWZLN1hOeVhjWVhMdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58b8b784-00de-4bf0-8163-c12b52383b74", "record_id": "flaws_cloudtrail:0000135:58b8b784-00de-4bf0-8163-c12b52383b74", "row_index": 135, "timestamp": "2019-03-26T00:13:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58b8b784-00de-4bf0-8163-c12b52383b74", "eventTime": "2019-03-26T00:13:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPVnNLSHhwS3htN3diTUdPUkdjTEdoWW5jaGRHajhHTTZFS2d4andIWkhsU0NNYnVoTmhMejdWbFZVdG1pbHdBN0JoRGhVSkVTQ3JYaFhKamREWFEwOUtkTVViS1FoTDFnMUUvd0U5WEdoaVRZdVpQQTcybU9LTVhLNWZPNmJIcGsyTVpkNUFhbGVFSUJ0UnR1dnorckRFTUhFMS91MWtVaDlQMXNBNHNLRUo5TmxBSDJab0pCZnZDeWZsaGhlYjN4TjBEK2FWRDJvL05JZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58b8b784-00de-4bf0-8163-c12b52383b74", "record_id": "flaws_cloudtrail:0000136:58b8b784-00de-4bf0-8163-c12b52383b74", "row_index": 136, "timestamp": "2019-03-26T00:13:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58b8b784-00de-4bf0-8163-c12b52383b74", "eventTime": "2019-03-26T00:13:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPVnNLSHhwS3htN3diTUdPUkdjTEdoWW5jaGRHajhHTTZFS2d4andIWkhsU0NNYnVoTmhMejdWbFZVdG1pbHdBN0JoRGhVSkVTQ3JYaFhKamREWFEwOUtkTVViS1FoTDFnMUUvd0U5WEdoaVRZdVpQQTcybU9LTVhLNWZPNmJIcGsyTVpkNUFhbGVFSUJ0UnR1dnorckRFTUhFMS91MWtVaDlQMXNBNHNLRUo5TmxBSDJab0pCZnZDeWZsaGhlYjN4TjBEK2FWRDJvL05JZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83d1755c-4b4b-4e43-9117-fcc9d36379e", "record_id": "flaws_cloudtrail:0000137:83d1755c-4b4b-4e43-9117-fcc9d36379e", "row_index": 137, "timestamp": "2019-03-26T00:13:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83d1755c-4b4b-4e43-9117-fcc9d36379e", "eventTime": "2019-03-26T00:13:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVMmVTS2c3ZFZ4WDJhTjYreWlEOWJYNjFTTWZZS2htUnBhTWJsT1M1TldseFZNMFp0ZGphYURheElDTGh3RGk1Ykowa3Vma0p4RU8rT2pESzBYTHdheDhLWTh1Uk1xZkxzTnBETmdoUnJJbEwxVXEranJmZFNyVG1zeFN4WGVNOU1mMkVUR3ZGcHczZW1rWGFUM3NFMVpwdXNHS3V2dEhSWklvZDhHY0ROTnI5TmhnS1EyV0RjZko5Mm9GR3BhZFdoejdTTDJ3L3JBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83d1755c-4b4b-4e43-9117-fcc9d36379e", "record_id": "flaws_cloudtrail:0000138:83d1755c-4b4b-4e43-9117-fcc9d36379e", "row_index": 138, "timestamp": "2019-03-26T00:13:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83d1755c-4b4b-4e43-9117-fcc9d36379e", "eventTime": "2019-03-26T00:13:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVMmVTS2c3ZFZ4WDJhTjYreWlEOWJYNjFTTWZZS2htUnBhTWJsT1M1TldseFZNMFp0ZGphYURheElDTGh3RGk1Ykowa3Vma0p4RU8rT2pESzBYTHdheDhLWTh1Uk1xZkxzTnBETmdoUnJJbEwxVXEranJmZFNyVG1zeFN4WGVNOU1mMkVUR3ZGcHczZW1rWGFUM3NFMVpwdXNHS3V2dEhSWklvZDhHY0ROTnI5TmhnS1EyV0RjZko5Mm9GR3BhZFdoejdTTDJ3L3JBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6fb132ea-2aa2-4c4d-91f9-082c43f8519e", "record_id": "flaws_cloudtrail:0000139:6fb132ea-2aa2-4c4d-91f9-082c43f8519e", "row_index": 139, "timestamp": "2019-03-26T00:13:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6fb132ea-2aa2-4c4d-91f9-082c43f8519e", "eventTime": "2019-03-26T00:13:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0N3hRS0JqR3ZjOTQ0eUNFZzluRU9ZMm45RUc3N0Vma2ZIZlhyMjUxS3g1SksyNW0yd242TE1QZnM4YVoveXhLN3lESEtCYWNoU3IzRkxyL3hqVXk1LzltYVlHV042YS9zdEg2Vzh1MnFXeCtjNkw3V1JZd2x5a2RIWUcwNElWQ3RoS1p4MENHVXJsWmd5YThKeGllUFp4VStVK0orQWYzdDV4TXRCakRRa29KOHZaUS9EeS9wQWRFcWpLTkp1L3J0WEZ0aVc0WlIyNWZoUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6fb132ea-2aa2-4c4d-91f9-082c43f8519e", "record_id": "flaws_cloudtrail:0000140:6fb132ea-2aa2-4c4d-91f9-082c43f8519e", "row_index": 140, "timestamp": "2019-03-26T00:13:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6fb132ea-2aa2-4c4d-91f9-082c43f8519e", "eventTime": "2019-03-26T00:13:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0N3hRS0JqR3ZjOTQ0eUNFZzluRU9ZMm45RUc3N0Vma2ZIZlhyMjUxS3g1SksyNW0yd242TE1QZnM4YVoveXhLN3lESEtCYWNoU3IzRkxyL3hqVXk1LzltYVlHV042YS9zdEg2Vzh1MnFXeCtjNkw3V1JZd2x5a2RIWUcwNElWQ3RoS1p4MENHVXJsWmd5YThKeGllUFp4VStVK0orQWYzdDV4TXRCakRRa29KOHZaUS9EeS9wQWRFcWpLTkp1L3J0WEZ0aVc0WlIyNWZoUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f233e40-c3fe-413e-a4c3-db644af13cdb", "record_id": "flaws_cloudtrail:0000141:9f233e40-c3fe-413e-a4c3-db644af13cdb", "row_index": 141, "timestamp": "2019-03-26T00:13:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f233e40-c3fe-413e-a4c3-db644af13cdb", "eventTime": "2019-03-26T00:13:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2VGR3OHNXQ2dLUUdCUDljZ0ZwYkVGRURMcEpRaGpaZXdMcDUxU1dGYzRiWjEwQUUrdytLYStmTDg3NVd1NGNSa0haeUY3VzFYajd2WGlWejNZTzJEMEErck9QQU1xRm1Ccmk0SHlyYlBqNVhDUU1pQjZ5NWp2dk5McWxXS21yZDIyc3hyVTV6TlIxTUVxdjVpaGJ6VlBDSEdXMmFWVDl2dWFPWVhONUhJUnRBcDRNMDd1eTg2dTZiNXU4Q2cwck5XbUJGM0pEWHp5RT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f233e40-c3fe-413e-a4c3-db644af13cdb", "record_id": "flaws_cloudtrail:0000142:9f233e40-c3fe-413e-a4c3-db644af13cdb", "row_index": 142, "timestamp": "2019-03-26T00:13:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f233e40-c3fe-413e-a4c3-db644af13cdb", "eventTime": "2019-03-26T00:13:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2VGR3OHNXQ2dLUUdCUDljZ0ZwYkVGRURMcEpRaGpaZXdMcDUxU1dGYzRiWjEwQUUrdytLYStmTDg3NVd1NGNSa0haeUY3VzFYajd2WGlWejNZTzJEMEErck9QQU1xRm1Ccmk0SHlyYlBqNVhDUU1pQjZ5NWp2dk5McWxXS21yZDIyc3hyVTV6TlIxTUVxdjVpaGJ6VlBDSEdXMmFWVDl2dWFPWVhONUhJUnRBcDRNMDd1eTg2dTZiNXU4Q2cwck5XbUJGM0pEWHp5RT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "210f9024-447f-4a1f-ae68-065752a26a9f", "record_id": "flaws_cloudtrail:0000143:210f9024-447f-4a1f-ae68-065752a26a9f", "row_index": 143, "timestamp": "2019-03-26T00:13:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "210f9024-447f-4a1f-ae68-065752a26a9f", "eventTime": "2019-03-26T00:13:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMU0lWQUxRUzNRYm4ybGZ0My91S1dNaFgrU0dWaU80bmVTMmRGSUtYSWNya2FadVFUeGNSbWFmM256cWZ2SmY2QTJYMFZGKzR2MWRRTEdLK05GbEZTdUdNMWQzakpCU2U4cVNiMFp5TG14SU9sSkFNS1RUeFUydHdVeHVvVVZHRThvTjFURUZET3JsRmZJTDdVWUUvTnVIb3ZiczZWdjRkRjBCS3Y3RnNTQnNYNVMwTS9ubE1OWVlFM1l1N1R3dmN6blAyeHdGSkNDQmZFZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "210f9024-447f-4a1f-ae68-065752a26a9f", "record_id": "flaws_cloudtrail:0000144:210f9024-447f-4a1f-ae68-065752a26a9f", "row_index": 144, "timestamp": "2019-03-26T00:13:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "210f9024-447f-4a1f-ae68-065752a26a9f", "eventTime": "2019-03-26T00:13:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMU0lWQUxRUzNRYm4ybGZ0My91S1dNaFgrU0dWaU80bmVTMmRGSUtYSWNya2FadVFUeGNSbWFmM256cWZ2SmY2QTJYMFZGKzR2MWRRTEdLK05GbEZTdUdNMWQzakpCU2U4cVNiMFp5TG14SU9sSkFNS1RUeFUydHdVeHVvVVZHRThvTjFURUZET3JsRmZJTDdVWUUvTnVIb3ZiczZWdjRkRjBCS3Y3RnNTQnNYNVMwTS9ubE1OWVlFM1l1N1R3dmN6blAyeHdGSkNDQmZFZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "344d8ec3-3df2-4619-acdd-ff4bd9227d08", "record_id": "flaws_cloudtrail:0000145:344d8ec3-3df2-4619-acdd-ff4bd9227d08", "row_index": 145, "timestamp": "2019-03-26T00:13:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "344d8ec3-3df2-4619-acdd-ff4bd9227d08", "eventTime": "2019-03-26T00:13:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5L0pIcmV3K1dvY21BK2NmeXFVNVpxdDV5cFhDTUQzNGRtZm5VbkV3dU9BY3JYL1BlVnFVemkyTFl5M2NzM00xcWVoQnpQTXdoS1A3enRGSFhjZDl2aDJ5S0hpL01tNk1tWEhZZDg3eWhyTUVQS3pxL0xhYlU4TmdNa0lmOXRYUHpYWTJwN1d2MDVOOW54SGd4Q2l2UHg1Nm5UdGIzdlpnd01YOVkzOGZ4RC9WamZaNFpYbURwRDRoNStDWS9ia1hsSmtUUmkyOU5QR3Vkdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "344d8ec3-3df2-4619-acdd-ff4bd9227d08", "record_id": "flaws_cloudtrail:0000146:344d8ec3-3df2-4619-acdd-ff4bd9227d08", "row_index": 146, "timestamp": "2019-03-26T00:13:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "344d8ec3-3df2-4619-acdd-ff4bd9227d08", "eventTime": "2019-03-26T00:13:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5L0pIcmV3K1dvY21BK2NmeXFVNVpxdDV5cFhDTUQzNGRtZm5VbkV3dU9BY3JYL1BlVnFVemkyTFl5M2NzM00xcWVoQnpQTXdoS1A3enRGSFhjZDl2aDJ5S0hpL01tNk1tWEhZZDg3eWhyTUVQS3pxL0xhYlU4TmdNa0lmOXRYUHpYWTJwN1d2MDVOOW54SGd4Q2l2UHg1Nm5UdGIzdlpnd01YOVkzOGZ4RC9WamZaNFpYbURwRDRoNStDWS9ia1hsSmtUUmkyOU5QR3Vkdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "635051-2ae7-44d1-88ca-ecd4f2df599c", "record_id": "flaws_cloudtrail:0000147:635051-2ae7-44d1-88ca-ecd4f2df599c", "row_index": 147, "timestamp": "2019-03-26T00:13:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "635051-2ae7-44d1-88ca-ecd4f2df599c", "eventTime": "2019-03-26T00:13:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYalRuTjFpbEE0TkRPeUdmWlRHSkh4OWtNUm94OE5ON2JLWUx2RnNIVEdGZkRWMTFRWXB2bGduK25mWWR6WFFPbkRhV3oxSTFONCtnQnRSRlF2QUxoUlBHN0NENzFrOVpNaHd0b2lxeHExd3gzTzEzTjduSmMyWWxWeTh4VVh2aEx5a1RqbmEzdU1xeFRGd0pNeHhmUHVSdEFKRWhpMFhRa1J3MGtncURtdWtwbWRnUEhYNENveXNkSVI5Q2REak5rcElzTm1KZVduZ2hZUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "635051-2ae7-44d1-88ca-ecd4f2df599c", "record_id": "flaws_cloudtrail:0000148:635051-2ae7-44d1-88ca-ecd4f2df599c", "row_index": 148, "timestamp": "2019-03-26T00:13:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "635051-2ae7-44d1-88ca-ecd4f2df599c", "eventTime": "2019-03-26T00:13:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYalRuTjFpbEE0TkRPeUdmWlRHSkh4OWtNUm94OE5ON2JLWUx2RnNIVEdGZkRWMTFRWXB2bGduK25mWWR6WFFPbkRhV3oxSTFONCtnQnRSRlF2QUxoUlBHN0NENzFrOVpNaHd0b2lxeHExd3gzTzEzTjduSmMyWWxWeTh4VVh2aEx5a1RqbmEzdU1xeFRGd0pNeHhmUHVSdEFKRWhpMFhRa1J3MGtncURtdWtwbWRnUEhYNENveXNkSVI5Q2REak5rcElzTm1KZVduZ2hZUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cf318761-b9e1-4598-878c-1875c8a831fa", "record_id": "flaws_cloudtrail:0000149:5cf318761-b9e1-4598-878c-1875c8a831fa", "row_index": 149, "timestamp": "2019-03-26T00:13:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cf318761-b9e1-4598-878c-1875c8a831fa", "eventTime": "2019-03-26T00:13:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZWEZlYjhjam9JNXlvbzA3aW5kb1lKN2xIT2NOUTBza2NzdEpiKzJ6S0gxY1ZtM3UwS0JZczhKVWdhOHMxOUE4TDNxRmtNdSsvL291ZTl4d3Q4TUxVZ1BMMjJwdlYvbG9BNnYvUXFWREpnSHFXL1pNOFBzYlNjKzFZZHhuR0JlZzNHWnJkb0pMQlJTVVhEbWR1NEFKNW1kRjN5eDN1U0xlT1NCYXF3cWxDcXlzNEdneFdSeDNpTFpRTGpEaFZVcFNZZk40N3J1S2RwSW5pQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cf318761-b9e1-4598-878c-1875c8a831fa", "record_id": "flaws_cloudtrail:0000150:5cf318761-b9e1-4598-878c-1875c8a831fa", "row_index": 150, "timestamp": "2019-03-26T00:13:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cf318761-b9e1-4598-878c-1875c8a831fa", "eventTime": "2019-03-26T00:13:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZWEZlYjhjam9JNXlvbzA3aW5kb1lKN2xIT2NOUTBza2NzdEpiKzJ6S0gxY1ZtM3UwS0JZczhKVWdhOHMxOUE4TDNxRmtNdSsvL291ZTl4d3Q4TUxVZ1BMMjJwdlYvbG9BNnYvUXFWREpnSHFXL1pNOFBzYlNjKzFZZHhuR0JlZzNHWnJkb0pMQlJTVVhEbWR1NEFKNW1kRjN5eDN1U0xlT1NCYXF3cWxDcXlzNEdneFdSeDNpTFpRTGpEaFZVcFNZZk40N3J1S2RwSW5pQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57e6c12e-5987-4f81-824e-6309a27de4bc", "record_id": "flaws_cloudtrail:0000151:57e6c12e-5987-4f81-824e-6309a27de4bc", "row_index": 151, "timestamp": "2019-03-26T00:13:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57e6c12e-5987-4f81-824e-6309a27de4bc", "eventTime": "2019-03-26T00:13:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEVkNaM3RDd3pZOGpCc2VZSWdjWjc5NVBTT0E5TVV4b2VWdW12T0hibWdIT01lVlpHcy9zTDUxZy8xUzRHLzM0ZjlLUmZaNFJrNU0zaGVDdHl4RHNjOHJZbFBOYlQ3S0NjTCtLOXZUTytIK0tTZHFLS0c4bXU0UjZRT3pRNnowQm14cE5Ya0FYWEswQyt4ZUU4emhsa2RLZC9mVDJRcXBOdE5WTjV5SlB4cXJ3SDZPYU5mMC9ubE5IK0c5S0ppc0NVOTZYZlpMRUp5SDlPQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57e6c12e-5987-4f81-824e-6309a27de4bc", "record_id": "flaws_cloudtrail:0000152:57e6c12e-5987-4f81-824e-6309a27de4bc", "row_index": 152, "timestamp": "2019-03-26T00:13:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57e6c12e-5987-4f81-824e-6309a27de4bc", "eventTime": "2019-03-26T00:13:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEVkNaM3RDd3pZOGpCc2VZSWdjWjc5NVBTT0E5TVV4b2VWdW12T0hibWdIT01lVlpHcy9zTDUxZy8xUzRHLzM0ZjlLUmZaNFJrNU0zaGVDdHl4RHNjOHJZbFBOYlQ3S0NjTCtLOXZUTytIK0tTZHFLS0c4bXU0UjZRT3pRNnowQm14cE5Ya0FYWEswQyt4ZUU4emhsa2RLZC9mVDJRcXBOdE5WTjV5SlB4cXJ3SDZPYU5mMC9ubE5IK0c5S0ppc0NVOTZYZlpMRUp5SDlPQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c9b90d-da87-46e2-8b7c-157345e2c9c3", "record_id": "flaws_cloudtrail:0000153:f8c9b90d-da87-46e2-8b7c-157345e2c9c3", "row_index": 153, "timestamp": "2019-03-26T00:13:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c9b90d-da87-46e2-8b7c-157345e2c9c3", "eventTime": "2019-03-26T00:13:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0enJVN0xFams4aEJIeXJNM3hpbTZFSHNRbUpSS0tGeHhyNG5wZ3FsMGt0WllTWjhnM2V1VktYckdQWTdsVzQzcjArY1MzclVFaTRaSnFubGh3U3JkcWs4dmRsVExmTkl4YXZJN2VFSkQreUlka2VuOGo4RFA2T0JMZlUyOVRxRGhHYzdabGNYc3RmUTd3alZQTUhrR0Zsc3RKOTBhbk9kcmZ4L2xsSzhJYWZMV2VVS1BWL21ERWFiZ3lkTCswSFd1MytoVENpZ2hnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c9b90d-da87-46e2-8b7c-157345e2c9c3", "record_id": "flaws_cloudtrail:0000154:f8c9b90d-da87-46e2-8b7c-157345e2c9c3", "row_index": 154, "timestamp": "2019-03-26T00:13:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c9b90d-da87-46e2-8b7c-157345e2c9c3", "eventTime": "2019-03-26T00:13:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0enJVN0xFams4aEJIeXJNM3hpbTZFSHNRbUpSS0tGeHhyNG5wZ3FsMGt0WllTWjhnM2V1VktYckdQWTdsVzQzcjArY1MzclVFaTRaSnFubGh3U3JkcWs4dmRsVExmTkl4YXZJN2VFSkQreUlka2VuOGo4RFA2T0JMZlUyOVRxRGhHYzdabGNYc3RmUTd3alZQTUhrR0Zsc3RKOTBhbk9kcmZ4L2xsSzhJYWZMV2VVS1BWL21ERWFiZ3lkTCswSFd1MytoVENpZ2hnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "887eb6b1-61fa-425e-b8bd-84b1b9b062cf", "record_id": "flaws_cloudtrail:0000155:887eb6b1-61fa-425e-b8bd-84b1b9b062cf", "row_index": 155, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "887eb6b1-61fa-425e-b8bd-84b1b9b062cf", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhT3BDb0dTUjhDdVlKU1pZMW9aS3hFYmMzWVZ1WnVjRHQxNWRDMFpqSHhNRWp1MXhSYTV6RWF4RHJoc1NEMmhCbDl1K1dtenVKeE0zTkFWQmdMUGhpV2E0ZHg4QTBPTFlYQ3ltWCt1U1Z3M3Z4d24vSS9oTE5Ea1NTdUZKTXNORVhHTll0cDRTVm5pQkVzd05WV2hpYjYwclZycUpKd2J2dmdsejZzbjZxVDEzZXlzT0Y1Y2R4VEp2RWNKaXd6bGVZUXNnak4wQk5OQlZWSjRGUGlxUnZuaWVOSlk1QktnPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1fd7bf1-22f8-45aa-8fb1-90b8c30cd605", "record_id": "flaws_cloudtrail:0000156:a1fd7bf1-22f8-45aa-8fb1-90b8c30cd605", "row_index": 156, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1fd7bf1-22f8-45aa-8fb1-90b8c30cd605", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwcmRqWHREcnNOYWIzVEU0YXBlUnZSSlB0VmZ2Q0VRYWEzMVVtMTR1U0MwdUVWaXRSV0xLTGhMWW5DQnhJOHZaOURoc0dqTTZTejlpMFd5bzN4NU0xekd0SmtjTm03U1pvRWRhSTc4amVOdG5wdVVhQTJkanI4M2E4Z1hIamlWOXpPdlBCYmp5cnQ5Q2RSeEttaDdYSHg0UjBLcVdpb1lNZW9WeTZBUDFNQnl3R2RaaW5oZFZPUG5DRGNHeVA1UWs3VVp3UWRJZUd3VVNhSVBBNnpPUk5lVFRZSEtqNFRrPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "061fe1c0-089d-4015-bd86-1f99d3d5f006", "record_id": "flaws_cloudtrail:0000157:061fe1c0-089d-4015-bd86-1f99d3d5f006", "row_index": 157, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "061fe1c0-089d-4015-bd86-1f99d3d5f006", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0cnNoeUttMDRPOG9BV3V0dHFpTm9lZzB0OXJwVW5DRXlHZ2RXRzhRSDBRODd4RWVUelVWYngvR2JENXVPSEFsRWtWN1phd0U1RmtxNDlFZVhXVTdaQkdXa0RDeGc3eGg3N21XZ2VhcTRaR01hayt4YlhlL0hRV1lzWXdnZ3k2STdiTklscjhaTWdham84WEVLUU00azFEdnpabGZZcGdvL3hLK0oxdVhNeU9GWDRuczJvemI4aDZiUEtCajNxWTlKMDhEdkZ0YklQUEJzUjZ0cm9uK2ZNdDJ2WjIrYXRRPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "570572f46-147b-468c-a838-0a342cf02a30", "record_id": "flaws_cloudtrail:0000158:570572f46-147b-468c-a838-0a342cf02a30", "row_index": 158, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "570572f46-147b-468c-a838-0a342cf02a30", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJidk42N0F5MWtNQ1RIVG5ueXdXNGNJRmx1KytrSkd0RnhiMHVIUnM1b3g3bkhHOHFSOHd5TmEycDJVd0RWL1VlcU95OFA0bmxOcUJlUEcyaW5oMnJ0djltditXYVJNcG1rQU5CS2xLRnBhU3gzaWFZK0NuMmQvQ09RWlpKb3psbXJrUlNaOFR0RDJpUUdQWlVDeXZUVnJ0M1ZGcHhIZHFUMXRZdG41YUh1aGFzZ3ByV25ORWtsejJXWFc5NDF0NkxSeFlNWU54VlFzTnJhcHUvRDIrMDBJS3hUOWdXUTZNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "887eb6b1-61fa-425e-b8bd-84b1b9b062cf", "record_id": "flaws_cloudtrail:0000159:887eb6b1-61fa-425e-b8bd-84b1b9b062cf", "row_index": 159, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "887eb6b1-61fa-425e-b8bd-84b1b9b062cf", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhT3BDb0dTUjhDdVlKU1pZMW9aS3hFYmMzWVZ1WnVjRHQxNWRDMFpqSHhNRWp1MXhSYTV6RWF4RHJoc1NEMmhCbDl1K1dtenVKeE0zTkFWQmdMUGhpV2E0ZHg4QTBPTFlYQ3ltWCt1U1Z3M3Z4d24vSS9oTE5Ea1NTdUZKTXNORVhHTll0cDRTVm5pQkVzd05WV2hpYjYwclZycUpKd2J2dmdsejZzbjZxVDEzZXlzT0Y1Y2R4VEp2RWNKaXd6bGVZUXNnak4wQk5OQlZWSjRGUGlxUnZuaWVOSlk1QktnPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1fd7bf1-22f8-45aa-8fb1-90b8c30cd605", "record_id": "flaws_cloudtrail:0000160:a1fd7bf1-22f8-45aa-8fb1-90b8c30cd605", "row_index": 160, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1fd7bf1-22f8-45aa-8fb1-90b8c30cd605", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwcmRqWHREcnNOYWIzVEU0YXBlUnZSSlB0VmZ2Q0VRYWEzMVVtMTR1U0MwdUVWaXRSV0xLTGhMWW5DQnhJOHZaOURoc0dqTTZTejlpMFd5bzN4NU0xekd0SmtjTm03U1pvRWRhSTc4amVOdG5wdVVhQTJkanI4M2E4Z1hIamlWOXpPdlBCYmp5cnQ5Q2RSeEttaDdYSHg0UjBLcVdpb1lNZW9WeTZBUDFNQnl3R2RaaW5oZFZPUG5DRGNHeVA1UWs3VVp3UWRJZUd3VVNhSVBBNnpPUk5lVFRZSEtqNFRrPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "061fe1c0-089d-4015-bd86-1f99d3d5f006", "record_id": "flaws_cloudtrail:0000161:061fe1c0-089d-4015-bd86-1f99d3d5f006", "row_index": 161, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "061fe1c0-089d-4015-bd86-1f99d3d5f006", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0cnNoeUttMDRPOG9BV3V0dHFpTm9lZzB0OXJwVW5DRXlHZ2RXRzhRSDBRODd4RWVUelVWYngvR2JENXVPSEFsRWtWN1phd0U1RmtxNDlFZVhXVTdaQkdXa0RDeGc3eGg3N21XZ2VhcTRaR01hayt4YlhlL0hRV1lzWXdnZ3k2STdiTklscjhaTWdham84WEVLUU00azFEdnpabGZZcGdvL3hLK0oxdVhNeU9GWDRuczJvemI4aDZiUEtCajNxWTlKMDhEdkZ0YklQUEJzUjZ0cm9uK2ZNdDJ2WjIrYXRRPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "570572f46-147b-468c-a838-0a342cf02a30", "record_id": "flaws_cloudtrail:0000162:570572f46-147b-468c-a838-0a342cf02a30", "row_index": 162, "timestamp": "2019-03-26T00:13:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "570572f46-147b-468c-a838-0a342cf02a30", "eventTime": "2019-03-26T00:13:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJidk42N0F5MWtNQ1RIVG5ueXdXNGNJRmx1KytrSkd0RnhiMHVIUnM1b3g3bkhHOHFSOHd5TmEycDJVd0RWL1VlcU95OFA0bmxOcUJlUEcyaW5oMnJ0djltditXYVJNcG1rQU5CS2xLRnBhU3gzaWFZK0NuMmQvQ09RWlpKb3psbXJrUlNaOFR0RDJpUUdQWlVDeXZUVnJ0M1ZGcHhIZHFUMXRZdG41YUh1aGFzZ3ByV25ORWtsejJXWFc5NDF0NkxSeFlNWU54VlFzTnJhcHUvRDIrMDBJS3hUOWdXUTZNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c680dcd7-507b-4970-a361-e76f2624cc19", "record_id": "flaws_cloudtrail:0000163:c680dcd7-507b-4970-a361-e76f2624cc19", "row_index": 163, "timestamp": "2019-03-26T00:13:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c680dcd7-507b-4970-a361-e76f2624cc19", "eventTime": "2019-03-26T00:13:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2VzJPZStkMEMzcnF3clRHQU4yNnA4bDNhU2c4Q2hsTklVMkJMdUsyVXl4WUdsQ0JyblQ4QWx1U2ZNZ01HbVZVTytoaGpibGJ0cVFPKy8xWTRzYXkyc2RIOUxmeXo1RTN0a3B0UUJlMzF3WE5SS1VmQmR2VlQzQU03Q1laMk53OXNvbDN1OG9leW8zNHBwaUtWWitxeUxHUjYrZmgxRk8vY0d6eFYxbE4yWDhURW4vYWhsc3lOOXhNYnZjaG1VWnFTaTdjT0l0eG1ZWTdkVlN0Sm5rd29kbWVhRUd6TkJRPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97d2ef3c-ebcf-4096-9211-d8bc16b1c377", "record_id": "flaws_cloudtrail:0000164:97d2ef3c-ebcf-4096-9211-d8bc16b1c377", "row_index": 164, "timestamp": "2019-03-26T00:13:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97d2ef3c-ebcf-4096-9211-d8bc16b1c377", "eventTime": "2019-03-26T00:13:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJETVh0YzhOdUdQb2prNWVjZUs1b01CRko0Wkx2cFAwemdYNnN1bm5HMDlmZnluUmdVRG1JY2xjaE45ZHJWdmlaaGVQYlJjODJDU0JPRzg1ZnVlT2FDQmw4Y01yaTRQYzVpSDJFOWIrNytQbllGYmZRNGZBbEFlbFE4OWVsVzk0N3I2UWo2eUcxWFhEUlRja0wxMys0citZSVhLTFZ6YWNDNmk1SEVMdWIvWTJWY21sVHB1YVd3VEdudi9lWGNVVnJmakhJcWMvbzFRZUNvRmhQQm1XNU1Dd2ZubU5jT0dVPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d051a0b3-03d5-4821-9968-489086fc158", "record_id": "flaws_cloudtrail:0000165:d051a0b3-03d5-4821-9968-489086fc158", "row_index": 165, "timestamp": "2019-03-26T00:13:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d051a0b3-03d5-4821-9968-489086fc158", "eventTime": "2019-03-26T00:13:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGRmttTEhVQXk0TWVVaHA1WkZ5WElIaU8xdHZiQjhtSG5qT084VGZSY3ZaRGI4eEFWSmN6ZzF4S2FId0p2dDZmdkJ2bFNsaWhjTFFUdnJZK1FSb3RzNkRiK2hWQ2lSaU1BenNMclRwVVJHWG1RSG96Z0dTcUR0ck9hTmgzNXJ1dnlyYjFRWFhURG5nSkxvRjhrRE9JSHBiYVlNaUVyRktUTURMMlBNb1RRc2o2ZDdGVE5YRU1JU1B5dHd5ckNuUTZYODJ3OWZLL3BNVEhRaVgvYm9rTEZ4L282dk1xYmNJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c680dcd7-507b-4970-a361-e76f2624cc19", "record_id": "flaws_cloudtrail:0000166:c680dcd7-507b-4970-a361-e76f2624cc19", "row_index": 166, "timestamp": "2019-03-26T00:13:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c680dcd7-507b-4970-a361-e76f2624cc19", "eventTime": "2019-03-26T00:13:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2VzJPZStkMEMzcnF3clRHQU4yNnA4bDNhU2c4Q2hsTklVMkJMdUsyVXl4WUdsQ0JyblQ4QWx1U2ZNZ01HbVZVTytoaGpibGJ0cVFPKy8xWTRzYXkyc2RIOUxmeXo1RTN0a3B0UUJlMzF3WE5SS1VmQmR2VlQzQU03Q1laMk53OXNvbDN1OG9leW8zNHBwaUtWWitxeUxHUjYrZmgxRk8vY0d6eFYxbE4yWDhURW4vYWhsc3lOOXhNYnZjaG1VWnFTaTdjT0l0eG1ZWTdkVlN0Sm5rd29kbWVhRUd6TkJRPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97d2ef3c-ebcf-4096-9211-d8bc16b1c377", "record_id": "flaws_cloudtrail:0000167:97d2ef3c-ebcf-4096-9211-d8bc16b1c377", "row_index": 167, "timestamp": "2019-03-26T00:13:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97d2ef3c-ebcf-4096-9211-d8bc16b1c377", "eventTime": "2019-03-26T00:13:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJETVh0YzhOdUdQb2prNWVjZUs1b01CRko0Wkx2cFAwemdYNnN1bm5HMDlmZnluUmdVRG1JY2xjaE45ZHJWdmlaaGVQYlJjODJDU0JPRzg1ZnVlT2FDQmw4Y01yaTRQYzVpSDJFOWIrNytQbllGYmZRNGZBbEFlbFE4OWVsVzk0N3I2UWo2eUcxWFhEUlRja0wxMys0citZSVhLTFZ6YWNDNmk1SEVMdWIvWTJWY21sVHB1YVd3VEdudi9lWGNVVnJmakhJcWMvbzFRZUNvRmhQQm1XNU1Dd2ZubU5jT0dVPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d051a0b3-03d5-4821-9968-489086fc158", "record_id": "flaws_cloudtrail:0000168:d051a0b3-03d5-4821-9968-489086fc158", "row_index": 168, "timestamp": "2019-03-26T00:13:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d051a0b3-03d5-4821-9968-489086fc158", "eventTime": "2019-03-26T00:13:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGRmttTEhVQXk0TWVVaHA1WkZ5WElIaU8xdHZiQjhtSG5qT084VGZSY3ZaRGI4eEFWSmN6ZzF4S2FId0p2dDZmdkJ2bFNsaWhjTFFUdnJZK1FSb3RzNkRiK2hWQ2lSaU1BenNMclRwVVJHWG1RSG96Z0dTcUR0ck9hTmgzNXJ1dnlyYjFRWFhURG5nSkxvRjhrRE9JSHBiYVlNaUVyRktUTURMMlBNb1RRc2o2ZDdGVE5YRU1JU1B5dHd5ckNuUTZYODJ3OWZLL3BNVEhRaVgvYm9rTEZ4L282dk1xYmNJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4cf781268-d01e-4747-8606-9c810cdc9400", "record_id": "flaws_cloudtrail:0000169:4cf781268-d01e-4747-8606-9c810cdc9400", "row_index": 169, "timestamp": "2019-03-26T00:14:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4cf781268-d01e-4747-8606-9c810cdc9400", "eventTime": "2019-03-26T00:14:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4cf781268-d01e-4747-8606-9c810cdc9400", "record_id": "flaws_cloudtrail:0000170:4cf781268-d01e-4747-8606-9c810cdc9400", "row_index": 170, "timestamp": "2019-03-26T00:14:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4cf781268-d01e-4747-8606-9c810cdc9400", "eventTime": "2019-03-26T00:14:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95db746c-e683-4ca5-bea2-caa33fd933ee", "record_id": "flaws_cloudtrail:0000171:95db746c-e683-4ca5-bea2-caa33fd933ee", "row_index": 171, "timestamp": "2019-03-26T01:09:28Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 660, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95db746c-e683-4ca5-bea2-caa33fd933ee", "eventTime": "2019-03-26T01:09:28Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95db746c-e683-4ca5-bea2-caa33fd933ee", "record_id": "flaws_cloudtrail:0000172:95db746c-e683-4ca5-bea2-caa33fd933ee", "row_index": 172, "timestamp": "2019-03-26T01:09:28Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 660, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95db746c-e683-4ca5-bea2-caa33fd933ee", "eventTime": "2019-03-26T01:09:28Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54628f7c-7b4b-4c2a-b8ac-5f7cf9af756c", "record_id": "flaws_cloudtrail:0000173:54628f7c-7b4b-4c2a-b8ac-5f7cf9af756c", "row_index": 173, "timestamp": "2019-03-26T01:10:03Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 660, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54628f7c-7b4b-4c2a-b8ac-5f7cf9af756c", "eventTime": "2019-03-26T01:10:03Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54628f7c-7b4b-4c2a-b8ac-5f7cf9af756c", "record_id": "flaws_cloudtrail:0000174:54628f7c-7b4b-4c2a-b8ac-5f7cf9af756c", "row_index": 174, "timestamp": "2019-03-26T01:10:03Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 660, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54628f7c-7b4b-4c2a-b8ac-5f7cf9af756c", "eventTime": "2019-03-26T01:10:03Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "240958a1b-cd04-4db2-ae22-850bef27f150", "record_id": "flaws_cloudtrail:0000175:240958a1b-cd04-4db2-ae22-850bef27f150", "row_index": 175, "timestamp": "2019-03-26T01:10:18Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 663, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "240958a1b-cd04-4db2-ae22-850bef27f150", "eventTime": "2019-03-26T01:10:18Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "240958a1b-cd04-4db2-ae22-850bef27f150", "record_id": "flaws_cloudtrail:0000176:240958a1b-cd04-4db2-ae22-850bef27f150", "row_index": 176, "timestamp": "2019-03-26T01:10:18Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 663, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "240958a1b-cd04-4db2-ae22-850bef27f150", "eventTime": "2019-03-26T01:10:18Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e9a0773-854b-4253-bb89-8464e78c759d", "record_id": "flaws_cloudtrail:0000177:1e9a0773-854b-4253-bb89-8464e78c759d", "row_index": 177, "timestamp": "2019-03-26T01:11:32Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e9a0773-854b-4253-bb89-8464e78c759d", "eventTime": "2019-03-26T01:11:32Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e9a0773-854b-4253-bb89-8464e78c759d", "record_id": "flaws_cloudtrail:0000178:1e9a0773-854b-4253-bb89-8464e78c759d", "row_index": 178, "timestamp": "2019-03-26T01:11:32Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e9a0773-854b-4253-bb89-8464e78c759d", "eventTime": "2019-03-26T01:11:32Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9900b985-7fe3-4243-bf6d-7e61d9351a25", "record_id": "flaws_cloudtrail:0000179:9900b985-7fe3-4243-bf6d-7e61d9351a25", "row_index": 179, "timestamp": "2019-03-26T01:13:15Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9900b985-7fe3-4243-bf6d-7e61d9351a25", "eventTime": "2019-03-26T01:13:15Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9900b985-7fe3-4243-bf6d-7e61d9351a25", "record_id": "flaws_cloudtrail:0000180:9900b985-7fe3-4243-bf6d-7e61d9351a25", "row_index": 180, "timestamp": "2019-03-26T01:13:15Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9900b985-7fe3-4243-bf6d-7e61d9351a25", "eventTime": "2019-03-26T01:13:15Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de59b530-4027-415b-b729-c66988b2d4d2", "record_id": "flaws_cloudtrail:0000181:de59b530-4027-415b-b729-c66988b2d4d2", "row_index": 181, "timestamp": "2019-03-26T01:15:01Z", "event_type": "GetUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 825, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de59b530-4027-415b-b729-c66988b2d4d2", "eventTime": "2019-03-26T01:15:01Z", "eventName": "GetUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The user policy with name list_apigateways cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": "list_apigateways", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de59b530-4027-415b-b729-c66988b2d4d2", "record_id": "flaws_cloudtrail:0000182:de59b530-4027-415b-b729-c66988b2d4d2", "row_index": 182, "timestamp": "2019-03-26T01:15:01Z", "event_type": "GetUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 825, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de59b530-4027-415b-b729-c66988b2d4d2", "eventTime": "2019-03-26T01:15:01Z", "eventName": "GetUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The user policy with name list_apigateways cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": "list_apigateways", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fcff7f7-2f3a-487f-b2e8-e60f49fe9dcc", "record_id": "flaws_cloudtrail:0000183:0fcff7f7-2f3a-487f-b2e8-e60f49fe9dcc", "row_index": 183, "timestamp": "2019-03-26T01:17:20Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fcff7f7-2f3a-487f-b2e8-e60f49fe9dcc", "eventTime": "2019-03-26T01:17:20Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fcff7f7-2f3a-487f-b2e8-e60f49fe9dcc", "record_id": "flaws_cloudtrail:0000184:0fcff7f7-2f3a-487f-b2e8-e60f49fe9dcc", "row_index": 184, "timestamp": "2019-03-26T01:17:20Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fcff7f7-2f3a-487f-b2e8-e60f49fe9dcc", "eventTime": "2019-03-26T01:17:20Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb5bb9e8-7256-420d-9aee-931d36836f9d", "record_id": "flaws_cloudtrail:0000185:eb5bb9e8-7256-420d-9aee-931d36836f9d", "row_index": 185, "timestamp": "2019-03-26T01:20:20Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb5bb9e8-7256-420d-9aee-931d36836f9d", "eventTime": "2019-03-26T01:20:20Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb5bb9e8-7256-420d-9aee-931d36836f9d", "record_id": "flaws_cloudtrail:0000186:eb5bb9e8-7256-420d-9aee-931d36836f9d", "row_index": 186, "timestamp": "2019-03-26T01:20:20Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb5bb9e8-7256-420d-9aee-931d36836f9d", "eventTime": "2019-03-26T01:20:20Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38371aa8-fde8-440b-85e5-9dcc612472", "record_id": "flaws_cloudtrail:0000187:38371aa8-fde8-440b-85e5-9dcc612472", "row_index": 187, "timestamp": "2019-03-26T01:21:02Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38371aa8-fde8-440b-85e5-9dcc612472", "eventTime": "2019-03-26T01:21:02Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38371aa8-fde8-440b-85e5-9dcc612472", "record_id": "flaws_cloudtrail:0000188:38371aa8-fde8-440b-85e5-9dcc612472", "row_index": 188, "timestamp": "2019-03-26T01:21:02Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38371aa8-fde8-440b-85e5-9dcc612472", "eventTime": "2019-03-26T01:21:02Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb5c842e-0a59-4d8e-816f-96da21c23e2a", "record_id": "flaws_cloudtrail:0000189:cb5c842e-0a59-4d8e-816f-96da21c23e2a", "row_index": 189, "timestamp": "2019-03-26T01:22:04Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 855, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb5c842e-0a59-4d8e-816f-96da21c23e2a", "eventTime": "2019-03-26T01:22:04Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb5c842e-0a59-4d8e-816f-96da21c23e2a", "record_id": "flaws_cloudtrail:0000190:cb5c842e-0a59-4d8e-816f-96da21c23e2a", "row_index": 190, "timestamp": "2019-03-26T01:22:04Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 855, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb5c842e-0a59-4d8e-816f-96da21c23e2a", "eventTime": "2019-03-26T01:22:04Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d815731-2ce5-4469-99d2-01dc4d6fc583", "record_id": "flaws_cloudtrail:0000191:0d815731-2ce5-4469-99d2-01dc4d6fc583", "row_index": 191, "timestamp": "2019-03-26T01:23:36Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d815731-2ce5-4469-99d2-01dc4d6fc583", "eventTime": "2019-03-26T01:23:36Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d815731-2ce5-4469-99d2-01dc4d6fc583", "record_id": "flaws_cloudtrail:0000192:0d815731-2ce5-4469-99d2-01dc4d6fc583", "row_index": 192, "timestamp": "2019-03-26T01:23:36Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d815731-2ce5-4469-99d2-01dc4d6fc583", "eventTime": "2019-03-26T01:23:36Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56c5fe68-2188-4fdd-8de5-7d5917bfc168", "record_id": "flaws_cloudtrail:0000193:56c5fe68-2188-4fdd-8de5-7d5917bfc168", "row_index": 193, "timestamp": "2019-03-26T01:23:48Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 855, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56c5fe68-2188-4fdd-8de5-7d5917bfc168", "eventTime": "2019-03-26T01:23:48Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56c5fe68-2188-4fdd-8de5-7d5917bfc168", "record_id": "flaws_cloudtrail:0000194:56c5fe68-2188-4fdd-8de5-7d5917bfc168", "row_index": 194, "timestamp": "2019-03-26T01:23:48Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 855, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56c5fe68-2188-4fdd-8de5-7d5917bfc168", "eventTime": "2019-03-26T01:23:48Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e4ab960-949f-4895-b202-a3741d501301", "record_id": "flaws_cloudtrail:0000195:2e4ab960-949f-4895-b202-a3741d501301", "row_index": 195, "timestamp": "2019-03-26T01:27:59Z", "event_type": "GetApiKeys", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e4ab960-949f-4895-b202-a3741d501301", "eventTime": "2019-03-26T01:27:59Z", "eventName": "GetApiKeys", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/apikeys", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e4ab960-949f-4895-b202-a3741d501301", "record_id": "flaws_cloudtrail:0000196:2e4ab960-949f-4895-b202-a3741d501301", "row_index": 196, "timestamp": "2019-03-26T01:27:59Z", "event_type": "GetApiKeys", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e4ab960-949f-4895-b202-a3741d501301", "eventTime": "2019-03-26T01:27:59Z", "eventName": "GetApiKeys", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/apikeys", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd18a390-9029-4bfc-a2b4-9d62b8d1036b", "record_id": "flaws_cloudtrail:0000197:dd18a390-9029-4bfc-a2b4-9d62b8d1036b", "row_index": 197, "timestamp": "2019-03-26T01:28:49Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 855, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd18a390-9029-4bfc-a2b4-9d62b8d1036b", "eventTime": "2019-03-26T01:28:49Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd18a390-9029-4bfc-a2b4-9d62b8d1036b", "record_id": "flaws_cloudtrail:0000198:dd18a390-9029-4bfc-a2b4-9d62b8d1036b", "row_index": 198, "timestamp": "2019-03-26T01:28:49Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 855, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd18a390-9029-4bfc-a2b4-9d62b8d1036b", "eventTime": "2019-03-26T01:28:49Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b518cb4a-74ee-4190-bf6b-19789e3814b8", "record_id": "flaws_cloudtrail:0000199:b518cb4a-74ee-4190-bf6b-19789e3814b8", "row_index": 199, "timestamp": "2019-03-26T01:32:33Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b518cb4a-74ee-4190-bf6b-19789e3814b8", "eventTime": "2019-03-26T01:32:33Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b518cb4a-74ee-4190-bf6b-19789e3814b8", "record_id": "flaws_cloudtrail:0000200:b518cb4a-74ee-4190-bf6b-19789e3814b8", "row_index": 200, "timestamp": "2019-03-26T01:32:33Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b518cb4a-74ee-4190-bf6b-19789e3814b8", "eventTime": "2019-03-26T01:32:33Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8802a7b-a184-4b70-b6ff-f42a4f877114", "record_id": "flaws_cloudtrail:0000201:f8802a7b-a184-4b70-b6ff-f42a4f877114", "row_index": 201, "timestamp": "2019-03-26T01:32:44Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8802a7b-a184-4b70-b6ff-f42a4f877114", "eventTime": "2019-03-26T01:32:44Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8802a7b-a184-4b70-b6ff-f42a4f877114", "record_id": "flaws_cloudtrail:0000202:f8802a7b-a184-4b70-b6ff-f42a4f877114", "row_index": 202, "timestamp": "2019-03-26T01:32:44Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8802a7b-a184-4b70-b6ff-f42a4f877114", "eventTime": "2019-03-26T01:32:44Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "430ea743-55d3-4b2c-993a-39786a40e1c2", "record_id": "flaws_cloudtrail:0000203:430ea743-55d3-4b2c-993a-39786a40e1c2", "row_index": 203, "timestamp": "2019-03-26T01:35:00Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "430ea743-55d3-4b2c-993a-39786a40e1c2", "eventTime": "2019-03-26T01:35:00Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "430ea743-55d3-4b2c-993a-39786a40e1c2", "record_id": "flaws_cloudtrail:0000204:430ea743-55d3-4b2c-993a-39786a40e1c2", "row_index": 204, "timestamp": "2019-03-26T01:35:00Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "430ea743-55d3-4b2c-993a-39786a40e1c2", "eventTime": "2019-03-26T01:35:00Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81c684363-33e4-4931-803b-594e937dff6e", "record_id": "flaws_cloudtrail:0000205:81c684363-33e4-4931-803b-594e937dff6e", "row_index": 205, "timestamp": "2019-03-26T01:35:47Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81c684363-33e4-4931-803b-594e937dff6e", "eventTime": "2019-03-26T01:35:47Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81c684363-33e4-4931-803b-594e937dff6e", "record_id": "flaws_cloudtrail:0000206:81c684363-33e4-4931-803b-594e937dff6e", "row_index": 206, "timestamp": "2019-03-26T01:35:47Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81c684363-33e4-4931-803b-594e937dff6e", "eventTime": "2019-03-26T01:35:47Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "361b6787-fb80-4271-b4eb-3a606b1ceb64", "record_id": "flaws_cloudtrail:0000207:361b6787-fb80-4271-b4eb-3a606b1ceb64", "row_index": 207, "timestamp": "2019-03-26T01:36:32Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "361b6787-fb80-4271-b4eb-3a606b1ceb64", "eventTime": "2019-03-26T01:36:32Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "361b6787-fb80-4271-b4eb-3a606b1ceb64", "record_id": "flaws_cloudtrail:0000208:361b6787-fb80-4271-b4eb-3a606b1ceb64", "row_index": 208, "timestamp": "2019-03-26T01:36:32Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "361b6787-fb80-4271-b4eb-3a606b1ceb64", "eventTime": "2019-03-26T01:36:32Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "289161-8a1f-4a3f-a884-7b14790a5", "record_id": "flaws_cloudtrail:0000209:289161-8a1f-4a3f-a884-7b14790a5", "row_index": 209, "timestamp": "2019-03-26T01:37:27Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAFU9LYHLVUI0TLMWS", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "206.253.243.144", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "289161-8a1f-4a3f-a884-7b14790a5", "eventTime": "2019-03-26T01:37:27Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "206.253.243.144", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAFU9LYHLVUI0TLMWS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T01:37:27Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/03/26/[$LATEST]4eb156990d0dc65d27dfba29261ce20b", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "289161-8a1f-4a3f-a884-7b14790a5", "record_id": "flaws_cloudtrail:0000210:289161-8a1f-4a3f-a884-7b14790a5", "row_index": 210, "timestamp": "2019-03-26T01:37:27Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAFU9LYHLVUI0TLMWS", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "206.253.243.144", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "289161-8a1f-4a3f-a884-7b14790a5", "eventTime": "2019-03-26T01:37:27Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "206.253.243.144", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAFU9LYHLVUI0TLMWS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T01:37:27Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/03/26/[$LATEST]4eb156990d0dc65d27dfba29261ce20b", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc7af0e6-775f-4952-b920-284574d91", "record_id": "flaws_cloudtrail:0000211:cc7af0e6-775f-4952-b920-284574d91", "row_index": 211, "timestamp": "2019-03-26T04:47:39Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.253.10.5", "user_agent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc7af0e6-775f-4952-b920-284574d91", "eventTime": "2019-03-26T04:47:39Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.253.10.5", "userAgent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc7af0e6-775f-4952-b920-284574d91", "record_id": "flaws_cloudtrail:0000212:cc7af0e6-775f-4952-b920-284574d91", "row_index": 212, "timestamp": "2019-03-26T04:47:39Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.253.10.5", "user_agent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc7af0e6-775f-4952-b920-284574d91", "eventTime": "2019-03-26T04:47:39Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.253.10.5", "userAgent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a48cf38b-f478-4bf3-87c3-975597879557", "record_id": "flaws_cloudtrail:0000213:a48cf38b-f478-4bf3-87c3-975597879557", "row_index": 213, "timestamp": "2019-03-26T04:50:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.253.10.5", "user_agent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a48cf38b-f478-4bf3-87c3-975597879557", "eventTime": "2019-03-26T04:50:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.253.10.5", "userAgent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a48cf38b-f478-4bf3-87c3-975597879557", "record_id": "flaws_cloudtrail:0000214:a48cf38b-f478-4bf3-87c3-975597879557", "row_index": 214, "timestamp": "2019-03-26T04:50:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.253.10.5", "user_agent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a48cf38b-f478-4bf3-87c3-975597879557", "eventTime": "2019-03-26T04:50:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.253.10.5", "userAgent": "aws-cli/1.16.130 Python/3.7.2 Darwin/18.2.0 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3531ba83-895a-4b59-8ac1-26f8c1bbefcb", "record_id": "flaws_cloudtrail:0000215:3531ba83-895a-4b59-8ac1-26f8c1bbefcb", "row_index": 215, "timestamp": "2019-03-26T14:15:18Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAUOZXQPXGDXM0SASF", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "16.7.150.20", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3531ba83-895a-4b59-8ac1-26f8c1bbefcb", "eventTime": "2019-03-26T14:15:18Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.7.150.20", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAUOZXQPXGDXM0SASF", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T14:15:18Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/03/26/[$LATEST]40a234e58a567c7ac64bf95e68f4ba7c", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3531ba83-895a-4b59-8ac1-26f8c1bbefcb", "record_id": "flaws_cloudtrail:0000216:3531ba83-895a-4b59-8ac1-26f8c1bbefcb", "row_index": 216, "timestamp": "2019-03-26T14:15:18Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAUOZXQPXGDXM0SASF", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "16.7.150.20", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3531ba83-895a-4b59-8ac1-26f8c1bbefcb", "eventTime": "2019-03-26T14:15:18Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.7.150.20", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAUOZXQPXGDXM0SASF", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T14:15:18Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/03/26/[$LATEST]40a234e58a567c7ac64bf95e68f4ba7c", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5e7251de-94ab-4325-8f87-d2a59cdacf6e", "record_id": "flaws_cloudtrail:0000217:5e7251de-94ab-4325-8f87-d2a59cdacf6e", "row_index": 217, "timestamp": "2019-03-26T14:36:18Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5e7251de-94ab-4325-8f87-d2a59cdacf6e", "eventTime": "2019-03-26T14:36:18Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5e7251de-94ab-4325-8f87-d2a59cdacf6e", "record_id": "flaws_cloudtrail:0000218:5e7251de-94ab-4325-8f87-d2a59cdacf6e", "row_index": 218, "timestamp": "2019-03-26T14:36:18Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5e7251de-94ab-4325-8f87-d2a59cdacf6e", "eventTime": "2019-03-26T14:36:18Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "481b4804-0506-45de-96aa-989088cfcedd", "record_id": "flaws_cloudtrail:0000219:481b4804-0506-45de-96aa-989088cfcedd", "row_index": 219, "timestamp": "2019-03-26T15:55:53Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "481b4804-0506-45de-96aa-989088cfcedd", "eventTime": "2019-03-26T15:55:53Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The user with name Level1 cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "481b4804-0506-45de-96aa-989088cfcedd", "record_id": "flaws_cloudtrail:0000220:481b4804-0506-45de-96aa-989088cfcedd", "row_index": 220, "timestamp": "2019-03-26T15:55:53Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "481b4804-0506-45de-96aa-989088cfcedd", "eventTime": "2019-03-26T15:55:53Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The user with name Level1 cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "844d5eb8-46db-4047-b4aa-e7fe6a586466", "record_id": "flaws_cloudtrail:0000221:844d5eb8-46db-4047-b4aa-e7fe6a586466", "row_index": 221, "timestamp": "2019-03-26T15:56:01Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 788, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "844d5eb8-46db-4047-b4aa-e7fe6a586466", "eventTime": "2019-03-26T15:56:01Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The user with name level1 cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "level1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "844d5eb8-46db-4047-b4aa-e7fe6a586466", "record_id": "flaws_cloudtrail:0000222:844d5eb8-46db-4047-b4aa-e7fe6a586466", "row_index": 222, "timestamp": "2019-03-26T15:56:01Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 788, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "844d5eb8-46db-4047-b4aa-e7fe6a586466", "eventTime": "2019-03-26T15:56:01Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The user with name level1 cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "level1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63e33618-faa8-4f94-a879-d39d5b2df744", "record_id": "flaws_cloudtrail:0000223:63e33618-faa8-4f94-a879-d39d5b2df744", "row_index": 223, "timestamp": "2019-03-26T15:56:49Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 658, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63e33618-faa8-4f94-a879-d39d5b2df744", "eventTime": "2019-03-26T15:56:49Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63e33618-faa8-4f94-a879-d39d5b2df744", "record_id": "flaws_cloudtrail:0000224:63e33618-faa8-4f94-a879-d39d5b2df744", "row_index": 224, "timestamp": "2019-03-26T15:56:49Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.255.118.50", "user_agent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 658, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63e33618-faa8-4f94-a879-d39d5b2df744", "eventTime": "2019-03-26T15:56:49Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.255.118.50", "userAgent": "aws-cli/1.15.75 Python/2.7.10 Darwin/18.2.0 botocore/1.10.74", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7299bd5-1a66-48f8-b0e1-12a0d9b20cb9", "record_id": "flaws_cloudtrail:0000225:a7299bd5-1a66-48f8-b0e1-12a0d9b20cb9", "row_index": 225, "timestamp": "2019-03-26T16:21:55Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7299bd5-1a66-48f8-b0e1-12a0d9b20cb9", "eventTime": "2019-03-26T16:21:55Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7299bd5-1a66-48f8-b0e1-12a0d9b20cb9", "record_id": "flaws_cloudtrail:0000226:a7299bd5-1a66-48f8-b0e1-12a0d9b20cb9", "row_index": 226, "timestamp": "2019-03-26T16:21:55Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7299bd5-1a66-48f8-b0e1-12a0d9b20cb9", "eventTime": "2019-03-26T16:21:55Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ac091926-8f06-4769-b749-3c734447d", "record_id": "flaws_cloudtrail:0000227:1ac091926-8f06-4769-b749-3c734447d", "row_index": 227, "timestamp": "2019-03-26T16:30:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 714, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ac091926-8f06-4769-b749-3c734447d", "eventTime": "2019-03-26T16:30:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ac091926-8f06-4769-b749-3c734447d", "record_id": "flaws_cloudtrail:0000228:1ac091926-8f06-4769-b749-3c734447d", "row_index": 228, "timestamp": "2019-03-26T16:30:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 714, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ac091926-8f06-4769-b749-3c734447d", "eventTime": "2019-03-26T16:30:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1be752c1-8d38-470a-a62f-32f899265dc9", "record_id": "flaws_cloudtrail:0000229:1be752c1-8d38-470a-a62f-32f899265dc9", "row_index": 229, "timestamp": "2019-03-26T16:31:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1be752c1-8d38-470a-a62f-32f899265dc9", "eventTime": "2019-03-26T16:31:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1be752c1-8d38-470a-a62f-32f899265dc9", "record_id": "flaws_cloudtrail:0000230:1be752c1-8d38-470a-a62f-32f899265dc9", "row_index": 230, "timestamp": "2019-03-26T16:31:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1be752c1-8d38-470a-a62f-32f899265dc9", "eventTime": "2019-03-26T16:31:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5f5764a-d931-4f3f-ba3c-a9380e92021a", "record_id": "flaws_cloudtrail:0000231:d5f5764a-d931-4f3f-ba3c-a9380e92021a", "row_index": 231, "timestamp": "2019-03-26T16:31:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5f5764a-d931-4f3f-ba3c-a9380e92021a", "eventTime": "2019-03-26T16:31:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3SWFnZG1YSlpnUVFyMG5VOXIzWmdMeVJmSGI3TEZtUjd3MC8vQkh3dEVSY2ZlSkNCQ2Y3VFZnQVN4bXdwMDlHVk56UFF0YldRUm9CdkJQNnJueG9KV014clE1aXdhbWR6ZEtzRTRWcW9qQit0NjFvTHF1c1hTV3pGbUczWlFqOXd3ZlRyOEx5QzgrNENWT0Rlb2xpNTczakJIMU1PZ1V0ZFJhZURMeTVKMEJ3R2ZidTlEelpBMFZwWnBtZ1BUN1kybkd3d3BiZUhPN2NWZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5f5764a-d931-4f3f-ba3c-a9380e92021a", "record_id": "flaws_cloudtrail:0000232:d5f5764a-d931-4f3f-ba3c-a9380e92021a", "row_index": 232, "timestamp": "2019-03-26T16:31:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5f5764a-d931-4f3f-ba3c-a9380e92021a", "eventTime": "2019-03-26T16:31:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3SWFnZG1YSlpnUVFyMG5VOXIzWmdMeVJmSGI3TEZtUjd3MC8vQkh3dEVSY2ZlSkNCQ2Y3VFZnQVN4bXdwMDlHVk56UFF0YldRUm9CdkJQNnJueG9KV014clE1aXdhbWR6ZEtzRTRWcW9qQit0NjFvTHF1c1hTV3pGbUczWlFqOXd3ZlRyOEx5QzgrNENWT0Rlb2xpNTczakJIMU1PZ1V0ZFJhZURMeTVKMEJ3R2ZidTlEelpBMFZwWnBtZ1BUN1kybkd3d3BiZUhPN2NWZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "096a5539-07c9-40e5-bbd9-97d185845f9d2", "record_id": "flaws_cloudtrail:0000233:096a5539-07c9-40e5-bbd9-97d185845f9d2", "row_index": 233, "timestamp": "2019-03-26T16:31:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "096a5539-07c9-40e5-bbd9-97d185845f9d2", "eventTime": "2019-03-26T16:31:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoY1pkVXh2MHVpOHRrbkhMdElWazQ1UDJ2MHJvbU5aaFQ3b2dnMUUvZFpvQWdYenhicWVBcU9JdTBuTGVUS0JGZG4zTWp4R2lMTDFzZWxVSTRmS3RGZ2RrTXJZSE5zTDJEWHdwc2VpOVVSeEN0ZFQzejFxTE42Q1NYQU02cHZzRnhRMDRlWEpycGpUcHA0NU11dklrbmY5NENoSXd5c0xXeUI0SG9WOWdzMkdBSE5rZW9ITldVa09aQ2FEbWhabVJDeFo0OTZFMXZaOG8zdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "096a5539-07c9-40e5-bbd9-97d185845f9d2", "record_id": "flaws_cloudtrail:0000234:096a5539-07c9-40e5-bbd9-97d185845f9d2", "row_index": 234, "timestamp": "2019-03-26T16:31:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "096a5539-07c9-40e5-bbd9-97d185845f9d2", "eventTime": "2019-03-26T16:31:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoY1pkVXh2MHVpOHRrbkhMdElWazQ1UDJ2MHJvbU5aaFQ3b2dnMUUvZFpvQWdYenhicWVBcU9JdTBuTGVUS0JGZG4zTWp4R2lMTDFzZWxVSTRmS3RGZ2RrTXJZSE5zTDJEWHdwc2VpOVVSeEN0ZFQzejFxTE42Q1NYQU02cHZzRnhRMDRlWEpycGpUcHA0NU11dklrbmY5NENoSXd5c0xXeUI0SG9WOWdzMkdBSE5rZW9ITldVa09aQ2FEbWhabVJDeFo0OTZFMXZaOG8zdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c5a7b8b-7a16-47ac-ae27-9a15af30fcd2", "record_id": "flaws_cloudtrail:0000235:2c5a7b8b-7a16-47ac-ae27-9a15af30fcd2", "row_index": 235, "timestamp": "2019-03-26T16:31:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1087, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c5a7b8b-7a16-47ac-ae27-9a15af30fcd2", "eventTime": "2019-03-26T16:31:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCRWI3czlyUEh1Rm00L1E3K1p4WnZVU0VPU2Ezc0pqRFp5SFFpdGJwajF0TkZBUVFnY3JpbkZLeDQrdTkrVjVXa2kxTVBwR2JFbHZ1d1duY0VQTkVSS2c0L2VHZ1dEVmFpM3V1Vjc3QUtKUThFV1VqKzdoMWVYTzFuRlE2V2VtdVhzTWhOZFdiSHRhTHZ0dEFvRWt6bittaytIR2tXUnpPR3NRK2NveUpmekNCSWh0U1VDK0MwM1ZhYmoxWW1NOU10QnZkSDV1MlJBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c5a7b8b-7a16-47ac-ae27-9a15af30fcd2", "record_id": "flaws_cloudtrail:0000236:2c5a7b8b-7a16-47ac-ae27-9a15af30fcd2", "row_index": 236, "timestamp": "2019-03-26T16:31:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1087, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c5a7b8b-7a16-47ac-ae27-9a15af30fcd2", "eventTime": "2019-03-26T16:31:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCRWI3czlyUEh1Rm00L1E3K1p4WnZVU0VPU2Ezc0pqRFp5SFFpdGJwajF0TkZBUVFnY3JpbkZLeDQrdTkrVjVXa2kxTVBwR2JFbHZ1d1duY0VQTkVSS2c0L2VHZ1dEVmFpM3V1Vjc3QUtKUThFV1VqKzdoMWVYTzFuRlE2V2VtdVhzTWhOZFdiSHRhTHZ0dEFvRWt6bittaytIR2tXUnpPR3NRK2NveUpmekNCSWh0U1VDK0MwM1ZhYmoxWW1NOU10QnZkSDV1MlJBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c9bba11-d558-4bd6-8283-ad1019d22236", "record_id": "flaws_cloudtrail:0000237:3c9bba11-d558-4bd6-8283-ad1019d22236", "row_index": 237, "timestamp": "2019-03-26T16:31:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c9bba11-d558-4bd6-8283-ad1019d22236", "eventTime": "2019-03-26T16:31:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDZFh2NkRXMGZJSXNHeTZmNUh2dmNJa2t5b0w4QlpUL3BGRmEvMXlFd0taN2F4eG9SdkRKY0o0NC9uQm5BMCt2RVJPWkZEQlJiQ1AwWFYyNHlEYms1bHE1SldMRmIwSHlTTVlabkZmNHc0L0l5R1Nib2lmVFo0TllEdURYbUczTm05cGdlSTRzclljcFZpcUhjSjRqazJteVVOVy83dlJpeVhmK3N0UHRidVRQc01QK0VrUlo0d3JTRkFoM2ZqLzZwK0lFSWtuNG5xemNtdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c9bba11-d558-4bd6-8283-ad1019d22236", "record_id": "flaws_cloudtrail:0000238:3c9bba11-d558-4bd6-8283-ad1019d22236", "row_index": 238, "timestamp": "2019-03-26T16:31:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c9bba11-d558-4bd6-8283-ad1019d22236", "eventTime": "2019-03-26T16:31:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDZFh2NkRXMGZJSXNHeTZmNUh2dmNJa2t5b0w4QlpUL3BGRmEvMXlFd0taN2F4eG9SdkRKY0o0NC9uQm5BMCt2RVJPWkZEQlJiQ1AwWFYyNHlEYms1bHE1SldMRmIwSHlTTVlabkZmNHc0L0l5R1Nib2lmVFo0TllEdURYbUczTm05cGdlSTRzclljcFZpcUhjSjRqazJteVVOVy83dlJpeVhmK3N0UHRidVRQc01QK0VrUlo0d3JTRkFoM2ZqLzZwK0lFSWtuNG5xemNtdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93cbbda3-92c9-417b-a0d8-389fd859c7ea", "record_id": "flaws_cloudtrail:0000239:93cbbda3-92c9-417b-a0d8-389fd859c7ea", "row_index": 239, "timestamp": "2019-03-26T16:31:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93cbbda3-92c9-417b-a0d8-389fd859c7ea", "eventTime": "2019-03-26T16:31:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxVGxOVEo2VE9iWVJqeTUvYklkRzFSNFF0U1M1T3ZtU3pmQVBVWlBGdFB2aCtqYy9GeFR4eCt6SUdZckNXWkZ6eENWQXpUVk02QUV3MTdLL0NSNEtRczdKQ0RPcGY4MEdpMDFWK3VuMS9oMzRIM3RwcTBWMUJxVHcxV2IzSld6RUt6NzVMUWUrYlVHOVM4ekFLWFpQM2RhTFRDWFgyb1M5TThJSHNNVXZlSzN2Qjg5V0xQWjlOK3ZsWU44aVFleW4wcEpUVGd4ZnkrYnk1QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93cbbda3-92c9-417b-a0d8-389fd859c7ea", "record_id": "flaws_cloudtrail:0000240:93cbbda3-92c9-417b-a0d8-389fd859c7ea", "row_index": 240, "timestamp": "2019-03-26T16:31:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93cbbda3-92c9-417b-a0d8-389fd859c7ea", "eventTime": "2019-03-26T16:31:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxVGxOVEo2VE9iWVJqeTUvYklkRzFSNFF0U1M1T3ZtU3pmQVBVWlBGdFB2aCtqYy9GeFR4eCt6SUdZckNXWkZ6eENWQXpUVk02QUV3MTdLL0NSNEtRczdKQ0RPcGY4MEdpMDFWK3VuMS9oMzRIM3RwcTBWMUJxVHcxV2IzSld6RUt6NzVMUWUrYlVHOVM4ekFLWFpQM2RhTFRDWFgyb1M5TThJSHNNVXZlSzN2Qjg5V0xQWjlOK3ZsWU44aVFleW4wcEpUVGd4ZnkrYnk1QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37ee387d-9c3a-436d-a382-4a515c4a7d94", "record_id": "flaws_cloudtrail:0000241:37ee387d-9c3a-436d-a382-4a515c4a7d94", "row_index": 241, "timestamp": "2019-03-26T16:31:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1087, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37ee387d-9c3a-436d-a382-4a515c4a7d94", "eventTime": "2019-03-26T16:31:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUWHhQWHZ6a2dxMjRCN1JpNUdIbHJOMytEMTlXNE9JT1ZnYkwrR21PbHNNN0ZMMFNtcG9RWU01Z0QwOWtDbEdJRER2S254SkVkSzVxY0ZkTWZuZDM2NXdZWUUreUJZckVCYmZMTUMvZU5RQ1NjMXRnUlFUdHNNNXFuaVNjM3oxditYbW1vZU9yMXFKaVdWZDdSNGlPNzFNZmh0Z0NZcmIwY3FCa1NaUkdiaXNuWEl6MDJzMW04a2l2dUxYeXNUWHFqWHN3K1AxNWZZTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37ee387d-9c3a-436d-a382-4a515c4a7d94", "record_id": "flaws_cloudtrail:0000242:37ee387d-9c3a-436d-a382-4a515c4a7d94", "row_index": 242, "timestamp": "2019-03-26T16:31:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1087, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37ee387d-9c3a-436d-a382-4a515c4a7d94", "eventTime": "2019-03-26T16:31:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUWHhQWHZ6a2dxMjRCN1JpNUdIbHJOMytEMTlXNE9JT1ZnYkwrR21PbHNNN0ZMMFNtcG9RWU01Z0QwOWtDbEdJRER2S254SkVkSzVxY0ZkTWZuZDM2NXdZWUUreUJZckVCYmZMTUMvZU5RQ1NjMXRnUlFUdHNNNXFuaVNjM3oxditYbW1vZU9yMXFKaVdWZDdSNGlPNzFNZmh0Z0NZcmIwY3FCa1NaUkdiaXNuWEl6MDJzMW04a2l2dUxYeXNUWHFqWHN3K1AxNWZZTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0052df8b-9ce5-4e04-865a-b2325fe25cf3", "record_id": "flaws_cloudtrail:0000243:0052df8b-9ce5-4e04-865a-b2325fe25cf3", "row_index": 243, "timestamp": "2019-03-26T16:31:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0052df8b-9ce5-4e04-865a-b2325fe25cf3", "eventTime": "2019-03-26T16:31:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5bW15bXBvY09nd2FmUml2RWNXZ1RocVcxMWZqQmNvVUlubVhZbXVETGl2WmVUMEp3cU81RVAyYlJKRGd6QmpkQ3ROM1BXcGhkZFRabTJRSFVjT0ZRb3hRUnEvOHhVWGVubmNaUDdFenFoT1JYY3dISnE0TUk5UGt5cjFiS1JtVGVKOUxLNnN3TzY0V1lMeWo4RkRpNS84ZjBrcVhaNUVXb3dGd1JWc0JHbmIxdlNtZHpIQm5SaWY1OVd1Yi9WWTUyMzZnN1FCN1BvY3drUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0052df8b-9ce5-4e04-865a-b2325fe25cf3", "record_id": "flaws_cloudtrail:0000244:0052df8b-9ce5-4e04-865a-b2325fe25cf3", "row_index": 244, "timestamp": "2019-03-26T16:31:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0052df8b-9ce5-4e04-865a-b2325fe25cf3", "eventTime": "2019-03-26T16:31:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5bW15bXBvY09nd2FmUml2RWNXZ1RocVcxMWZqQmNvVUlubVhZbXVETGl2WmVUMEp3cU81RVAyYlJKRGd6QmpkQ3ROM1BXcGhkZFRabTJRSFVjT0ZRb3hRUnEvOHhVWGVubmNaUDdFenFoT1JYY3dISnE0TUk5UGt5cjFiS1JtVGVKOUxLNnN3TzY0V1lMeWo4RkRpNS84ZjBrcVhaNUVXb3dGd1JWc0JHbmIxdlNtZHpIQm5SaWY1OVd1Yi9WWTUyMzZnN1FCN1BvY3drUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2fc5923-47de-476a-b210-82afec506cd1", "record_id": "flaws_cloudtrail:0000245:f2fc5923-47de-476a-b210-82afec506cd1", "row_index": 245, "timestamp": "2019-03-26T16:31:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2fc5923-47de-476a-b210-82afec506cd1", "eventTime": "2019-03-26T16:31:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXRUpKdVZ1TDFnTDBHakt6MmU4VDZLTDcvNmJzNEdkb2wzVGdrTnpieDBkTTN4OTdtdjJHVnZKdSt6KzR2ZnBSMm1TNGVhTFFDL3JMQ2NXTEdtSk9WeHF2QjQ3NnRCM0Z6bm0ycysrSjhVZ25DTTVTOFNmSmR5VzhQbEZXVldZR2VXWFV4Z1lMYUVZMHdYUFdIRWV2TzFrNVlIYkNoWkVMNlA1Qkw4M1pwaDIvc2V1Q0I5TFdQcktxRjBCeWUzWGsyOGV2ZEVrSWFBTHZTQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2fc5923-47de-476a-b210-82afec506cd1", "record_id": "flaws_cloudtrail:0000246:f2fc5923-47de-476a-b210-82afec506cd1", "row_index": 246, "timestamp": "2019-03-26T16:31:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2fc5923-47de-476a-b210-82afec506cd1", "eventTime": "2019-03-26T16:31:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXRUpKdVZ1TDFnTDBHakt6MmU4VDZLTDcvNmJzNEdkb2wzVGdrTnpieDBkTTN4OTdtdjJHVnZKdSt6KzR2ZnBSMm1TNGVhTFFDL3JMQ2NXTEdtSk9WeHF2QjQ3NnRCM0Z6bm0ycysrSjhVZ25DTTVTOFNmSmR5VzhQbEZXVldZR2VXWFV4Z1lMYUVZMHdYUFdIRWV2TzFrNVlIYkNoWkVMNlA1Qkw4M1pwaDIvc2V1Q0I5TFdQcktxRjBCeWUzWGsyOGV2ZEVrSWFBTHZTQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "792feb30-8bf2-4ca2-97c0-1cf44fff3e11", "record_id": "flaws_cloudtrail:0000247:792feb30-8bf2-4ca2-97c0-1cf44fff3e11", "row_index": 247, "timestamp": "2019-03-26T16:31:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "792feb30-8bf2-4ca2-97c0-1cf44fff3e11", "eventTime": "2019-03-26T16:31:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIyZ0NjSGNQVjhVRXhwcWNlZU5VU1I2MTVrZHlycjlaREJFZ29sdnhxWFROWFlPeDM0SW94RXlZZ3lFL1RieUpXaytmam5lZm9TbmhCdkpuRW00YWQ4OUtQNlNvQmVhU1NTS2RBcnE1UEE0Si84NTlOZEVOenZuS3I1RzBKU0dZNkFjbXZiQXl0L2l6OElITVoxQmJCbHd3SU50NkNaMEdHcUFVWStER2pFNGV4REYwT2xzcXZQcUVSeUJVemljYVVPZHYwV0dkMXNDZzFBZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "792feb30-8bf2-4ca2-97c0-1cf44fff3e11", "record_id": "flaws_cloudtrail:0000248:792feb30-8bf2-4ca2-97c0-1cf44fff3e11", "row_index": 248, "timestamp": "2019-03-26T16:31:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "792feb30-8bf2-4ca2-97c0-1cf44fff3e11", "eventTime": "2019-03-26T16:31:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIyZ0NjSGNQVjhVRXhwcWNlZU5VU1I2MTVrZHlycjlaREJFZ29sdnhxWFROWFlPeDM0SW94RXlZZ3lFL1RieUpXaytmam5lZm9TbmhCdkpuRW00YWQ4OUtQNlNvQmVhU1NTS2RBcnE1UEE0Si84NTlOZEVOenZuS3I1RzBKU0dZNkFjbXZiQXl0L2l6OElITVoxQmJCbHd3SU50NkNaMEdHcUFVWStER2pFNGV4REYwT2xzcXZQcUVSeUJVemljYVVPZHYwV0dkMXNDZzFBZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79cf19a1-cc50-40cf-9d3d-33b59ff9c4fa", "record_id": "flaws_cloudtrail:0000249:79cf19a1-cc50-40cf-9d3d-33b59ff9c4fa", "row_index": 249, "timestamp": "2019-03-26T16:31:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79cf19a1-cc50-40cf-9d3d-33b59ff9c4fa", "eventTime": "2019-03-26T16:31:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxUFZKR01HR203QUFPR0gxUmtlMDZ1THJqN29lTnQ2SDhsTHBQa1J4ODJtQ29HemtORkVwQU13TVB3ZkNJSWxoTlQwc3Z1RG8zNmhhR1ljK0NsVWsvTm9OZzNXS0pWNFVpbGJGZ0R0ei9lZ3FSL2ZZOXRpZW5zMEpNWnZ3NkJnZzBzUlIrWHo4bzdIdko5Yi9LVDQxTFJSZjFtMzhLYzd4WnpEbHFJeGFzcHRYQXVWZ0p3bmdwU1YvMTJVcnBUQ1MzdFEyVm1haFZ1b2tCZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79cf19a1-cc50-40cf-9d3d-33b59ff9c4fa", "record_id": "flaws_cloudtrail:0000250:79cf19a1-cc50-40cf-9d3d-33b59ff9c4fa", "row_index": 250, "timestamp": "2019-03-26T16:31:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79cf19a1-cc50-40cf-9d3d-33b59ff9c4fa", "eventTime": "2019-03-26T16:31:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxUFZKR01HR203QUFPR0gxUmtlMDZ1THJqN29lTnQ2SDhsTHBQa1J4ODJtQ29HemtORkVwQU13TVB3ZkNJSWxoTlQwc3Z1RG8zNmhhR1ljK0NsVWsvTm9OZzNXS0pWNFVpbGJGZ0R0ei9lZ3FSL2ZZOXRpZW5zMEpNWnZ3NkJnZzBzUlIrWHo4bzdIdko5Yi9LVDQxTFJSZjFtMzhLYzd4WnpEbHFJeGFzcHRYQXVWZ0p3bmdwU1YvMTJVcnBUQ1MzdFEyVm1haFZ1b2tCZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b11ba837-7533-47e1-b78a-b1510b973c3f", "record_id": "flaws_cloudtrail:0000251:b11ba837-7533-47e1-b78a-b1510b973c3f", "row_index": 251, "timestamp": "2019-03-26T16:31:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1085, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b11ba837-7533-47e1-b78a-b1510b973c3f", "eventTime": "2019-03-26T16:31:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4eGxPVmpYdHlnOHplRnZiNG9WRDVzaXlmd3V5Z0VEVERsL3ZrTk5Dc1VqbnRLNXo0bCtKR2hmRVVmVFcwSHA0SkI4RWw2WnpyVE80L2V3czlVUlJIZE5LR084WkpRaE12TllLUEoyd2g4bGx1R0NUSTlZNDhVVVhwM3hZSThNZXVacXNObHJBRm1SVXVyd0lnMGcxMEsrZ2RTc1hBbndBU3hXdUwraWViOG1MUGk1VEhQREdyRW5DN3F6LzFUbDJXUkY1RWErSUR6MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b11ba837-7533-47e1-b78a-b1510b973c3f", "record_id": "flaws_cloudtrail:0000252:b11ba837-7533-47e1-b78a-b1510b973c3f", "row_index": 252, "timestamp": "2019-03-26T16:31:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1085, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b11ba837-7533-47e1-b78a-b1510b973c3f", "eventTime": "2019-03-26T16:31:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4eGxPVmpYdHlnOHplRnZiNG9WRDVzaXlmd3V5Z0VEVERsL3ZrTk5Dc1VqbnRLNXo0bCtKR2hmRVVmVFcwSHA0SkI4RWw2WnpyVE80L2V3czlVUlJIZE5LR084WkpRaE12TllLUEoyd2g4bGx1R0NUSTlZNDhVVVhwM3hZSThNZXVacXNObHJBRm1SVXVyd0lnMGcxMEsrZ2RTc1hBbndBU3hXdUwraWViOG1MUGk1VEhQREdyRW5DN3F6LzFUbDJXUkY1RWErSUR6MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e584e7da-7e32-420f-a38e-9b3e9aa62b19", "record_id": "flaws_cloudtrail:0000253:e584e7da-7e32-420f-a38e-9b3e9aa62b19", "row_index": 253, "timestamp": "2019-03-26T16:31:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e584e7da-7e32-420f-a38e-9b3e9aa62b19", "eventTime": "2019-03-26T16:31:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJyRHRGZy9oemYyRlpLdmcrenhtVzVnMWwyK2Y5cWZZdXRLQW8yUml6NDVnOGpIVm5UK00xOUJyT3FaNkdIMjRvRFNtcEZOaEhpdGVmMWdMMHNzb0JuYWlIZ1VsUTlUc3cvQ3ZyRW9ZR1dSNlVnbURtSCs0SElWTjQza211V25UaEQ0R1AvOEFYR3dwaC80UnNjZHZRZEYzcEJmZlgrMWkzVWlIcjdJWXVPQVpobVlmQ0s1NWkwdGVMcm1ZSitCU0ZrajAzcStONStPYXRCUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e584e7da-7e32-420f-a38e-9b3e9aa62b19", "record_id": "flaws_cloudtrail:0000254:e584e7da-7e32-420f-a38e-9b3e9aa62b19", "row_index": 254, "timestamp": "2019-03-26T16:31:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e584e7da-7e32-420f-a38e-9b3e9aa62b19", "eventTime": "2019-03-26T16:31:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJyRHRGZy9oemYyRlpLdmcrenhtVzVnMWwyK2Y5cWZZdXRLQW8yUml6NDVnOGpIVm5UK00xOUJyT3FaNkdIMjRvRFNtcEZOaEhpdGVmMWdMMHNzb0JuYWlIZ1VsUTlUc3cvQ3ZyRW9ZR1dSNlVnbURtSCs0SElWTjQza211V25UaEQ0R1AvOEFYR3dwaC80UnNjZHZRZEYzcEJmZlgrMWkzVWlIcjdJWXVPQVpobVlmQ0s1NWkwdGVMcm1ZSitCU0ZrajAzcStONStPYXRCUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "129047f6e-1e7a-4e9b-95e4-9cddfeec45fe", "record_id": "flaws_cloudtrail:0000255:129047f6e-1e7a-4e9b-95e4-9cddfeec45fe", "row_index": 255, "timestamp": "2019-03-26T16:32:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "129047f6e-1e7a-4e9b-95e4-9cddfeec45fe", "eventTime": "2019-03-26T16:32:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5UlVjZTNsd2dtN0IyT1AzdHNhYkVWdDl6cmNtbkJyMEZrT2RlODBuL01WMUdjUG1VRzBWZ3dqQk94OXprSGx5NFZycCthYjdtVWFmeVljWHJPNTNEMU13RjZwSENTVWdtRWRhZjQ0L0VoWlRCbU9MNVJOTGdnOXlWbFduS09qdXlacjVDTzk0K1hmRE4yYzJwejFRd0lNQXNZN0thUlcvdGxOb1dkODBJYXlEaXVKWmUxeXVIb0NpK2RNZXZnMzJMdjlzcDlKMXFnQlA3Zz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d0dd884-af9d-402d-bee4-ad41f8fbc5c7", "record_id": "flaws_cloudtrail:0000256:5d0dd884-af9d-402d-bee4-ad41f8fbc5c7", "row_index": 256, "timestamp": "2019-03-26T16:32:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d0dd884-af9d-402d-bee4-ad41f8fbc5c7", "eventTime": "2019-03-26T16:32:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2VzVudm1hY01RWHcwSi90RDNJREhsWWZkZStrSlFUVkhMMTRrVlJLaE9HNkhVbWllOERhQ3hWQUNjaWRKcm5hRzdvTHpEbmY0d0FZTXFEd1p5RXlzR09MNEFKT3NYUUQyR0lFdGNJUEVCRTkvajFXb0p1R0ZoM1pYN2pQZ1pmekd4WDJWZlpCZGlnYkFLSHAvRUxxbU5scjRVcDFFdzNBK2cyQ0xKaHh5WUk5bm5YdEd6YUt6bGxYRHpRcHV3b3lkdXNPekxoUEJab3Z0Zz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "129047f6e-1e7a-4e9b-95e4-9cddfeec45fe", "record_id": "flaws_cloudtrail:0000257:129047f6e-1e7a-4e9b-95e4-9cddfeec45fe", "row_index": 257, "timestamp": "2019-03-26T16:32:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "129047f6e-1e7a-4e9b-95e4-9cddfeec45fe", "eventTime": "2019-03-26T16:32:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5UlVjZTNsd2dtN0IyT1AzdHNhYkVWdDl6cmNtbkJyMEZrT2RlODBuL01WMUdjUG1VRzBWZ3dqQk94OXprSGx5NFZycCthYjdtVWFmeVljWHJPNTNEMU13RjZwSENTVWdtRWRhZjQ0L0VoWlRCbU9MNVJOTGdnOXlWbFduS09qdXlacjVDTzk0K1hmRE4yYzJwejFRd0lNQXNZN0thUlcvdGxOb1dkODBJYXlEaXVKWmUxeXVIb0NpK2RNZXZnMzJMdjlzcDlKMXFnQlA3Zz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d0dd884-af9d-402d-bee4-ad41f8fbc5c7", "record_id": "flaws_cloudtrail:0000258:5d0dd884-af9d-402d-bee4-ad41f8fbc5c7", "row_index": 258, "timestamp": "2019-03-26T16:32:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d0dd884-af9d-402d-bee4-ad41f8fbc5c7", "eventTime": "2019-03-26T16:32:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2VzVudm1hY01RWHcwSi90RDNJREhsWWZkZStrSlFUVkhMMTRrVlJLaE9HNkhVbWllOERhQ3hWQUNjaWRKcm5hRzdvTHpEbmY0d0FZTXFEd1p5RXlzR09MNEFKT3NYUUQyR0lFdGNJUEVCRTkvajFXb0p1R0ZoM1pYN2pQZ1pmekd4WDJWZlpCZGlnYkFLSHAvRUxxbU5scjRVcDFFdzNBK2cyQ0xKaHh5WUk5bm5YdEd6YUt6bGxYRHpRcHV3b3lkdXNPekxoUEJab3Z0Zz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6395d6c8-314f-4e6b-ad1a-18df7d13171a", "record_id": "flaws_cloudtrail:0000259:6395d6c8-314f-4e6b-ad1a-18df7d13171a", "row_index": 259, "timestamp": "2019-03-26T16:32:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6395d6c8-314f-4e6b-ad1a-18df7d13171a", "eventTime": "2019-03-26T16:32:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5QlJGMUw4ZEwrWVIzbFRSV09RcFRPNTFXd0tNZElObXY4L3JrZHBXUFlmMmRyM1k5eFE2MW1JK2FxaFpxNEl3NHorWjRlQ1JIazdXTnRWOS9CRlo0OFM2YzBaeHdQSnNWeGc0RUZzSGNMUjV5bXdxK2EybDRweFFlejV5ZW51NUxpSTRpZ2xNWEh1cE0zV1p3Y2REeDdSL1pFWkdIR1dqMEhzQlFkK3drbTRkaE11QzhweVFrTjlUM2FmMnJNbzY2bGpKMWxwOVZMUnNNc1JCY0lHU2lybmVYaE1ZK2pNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6395d6c8-314f-4e6b-ad1a-18df7d13171a", "record_id": "flaws_cloudtrail:0000260:6395d6c8-314f-4e6b-ad1a-18df7d13171a", "row_index": 260, "timestamp": "2019-03-26T16:32:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6395d6c8-314f-4e6b-ad1a-18df7d13171a", "eventTime": "2019-03-26T16:32:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5QlJGMUw4ZEwrWVIzbFRSV09RcFRPNTFXd0tNZElObXY4L3JrZHBXUFlmMmRyM1k5eFE2MW1JK2FxaFpxNEl3NHorWjRlQ1JIazdXTnRWOS9CRlo0OFM2YzBaeHdQSnNWeGc0RUZzSGNMUjV5bXdxK2EybDRweFFlejV5ZW51NUxpSTRpZ2xNWEh1cE0zV1p3Y2REeDdSL1pFWkdIR1dqMEhzQlFkK3drbTRkaE11QzhweVFrTjlUM2FmMnJNbzY2bGpKMWxwOVZMUnNNc1JCY0lHU2lybmVYaE1ZK2pNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f82a8093-82b8-41cf-b1a5-fd7c7ca04c02", "record_id": "flaws_cloudtrail:0000261:f82a8093-82b8-41cf-b1a5-fd7c7ca04c02", "row_index": 261, "timestamp": "2019-03-26T16:32:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f82a8093-82b8-41cf-b1a5-fd7c7ca04c02", "eventTime": "2019-03-26T16:32:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPdlBVTjVPZndFQUIyUHlNcjJ6TGlpY1lOOWxRRTVWTUU3emg1bGFReWVRRElOeVJaL3BGZjNvaWoyTzJTQ2NKRFpiWHFKT2xOTFRIZ0s1ZFBvTGcyQUMrNU9MWjR3WXkzMDhFbWdCZFFLZzdwUE95NTUvNW9ZVlFzY3hJQitCUkJFdlRjNEVmMi9HS1NISWVsdkJoRDdQVjlKVDc0Q1VzZ09zWlI3QzJ1emhtZlc2akZJT2RhbWVuMDBHNk9OclY0d2VKWU1vblRIeVVQMEFHa0F6TkVvWkpraUN1RzJ3PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbaed35b-aba5-40a2-a896-a4e76ad7c34d", "record_id": "flaws_cloudtrail:0000262:fbaed35b-aba5-40a2-a896-a4e76ad7c34d", "row_index": 262, "timestamp": "2019-03-26T16:32:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbaed35b-aba5-40a2-a896-a4e76ad7c34d", "eventTime": "2019-03-26T16:32:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYamxnaVFZc0FKc00xL1lrNUg2aCtuN1FteW5sTVdaaUkybkxoS1BNeXNzWit6QU84S2dIcXpmbTk2blNJMENjTWdiWFpvZDZmMmRVcEFQMW55dkpjMXpLSjdXK09BeHFYVzlSYXBacE9nNHZQdEp5RCtxcmZBMSs0OXNkR1VRWVJlS2xQb2gwZEMxVXhzdjI2bVdYYXF2TUNrNURYbHdRZndTeVRQaVJ4ZE10RFRWSmJoMlh0Tkw1VW96dnY2cz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f82a8093-82b8-41cf-b1a5-fd7c7ca04c02", "record_id": "flaws_cloudtrail:0000263:f82a8093-82b8-41cf-b1a5-fd7c7ca04c02", "row_index": 263, "timestamp": "2019-03-26T16:32:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f82a8093-82b8-41cf-b1a5-fd7c7ca04c02", "eventTime": "2019-03-26T16:32:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPdlBVTjVPZndFQUIyUHlNcjJ6TGlpY1lOOWxRRTVWTUU3emg1bGFReWVRRElOeVJaL3BGZjNvaWoyTzJTQ2NKRFpiWHFKT2xOTFRIZ0s1ZFBvTGcyQUMrNU9MWjR3WXkzMDhFbWdCZFFLZzdwUE95NTUvNW9ZVlFzY3hJQitCUkJFdlRjNEVmMi9HS1NISWVsdkJoRDdQVjlKVDc0Q1VzZ09zWlI3QzJ1emhtZlc2akZJT2RhbWVuMDBHNk9OclY0d2VKWU1vblRIeVVQMEFHa0F6TkVvWkpraUN1RzJ3PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbaed35b-aba5-40a2-a896-a4e76ad7c34d", "record_id": "flaws_cloudtrail:0000264:fbaed35b-aba5-40a2-a896-a4e76ad7c34d", "row_index": 264, "timestamp": "2019-03-26T16:32:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbaed35b-aba5-40a2-a896-a4e76ad7c34d", "eventTime": "2019-03-26T16:32:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYamxnaVFZc0FKc00xL1lrNUg2aCtuN1FteW5sTVdaaUkybkxoS1BNeXNzWit6QU84S2dIcXpmbTk2blNJMENjTWdiWFpvZDZmMmRVcEFQMW55dkpjMXpLSjdXK09BeHFYVzlSYXBacE9nNHZQdEp5RCtxcmZBMSs0OXNkR1VRWVJlS2xQb2gwZEMxVXhzdjI2bVdYYXF2TUNrNURYbHdRZndTeVRQaVJ4ZE10RFRWSmJoMlh0Tkw1VW96dnY2cz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6f8c7e5-be01-4a7e-976e-94678e3aac1e", "record_id": "flaws_cloudtrail:0000265:b6f8c7e5-be01-4a7e-976e-94678e3aac1e", "row_index": 265, "timestamp": "2019-03-26T16:32:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6f8c7e5-be01-4a7e-976e-94678e3aac1e", "eventTime": "2019-03-26T16:32:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTRW9mc2FhR2tKZ1EwTDdxUkQzOVY4Z2JCa2dJb1JMbGd6Qm5PQnBDdDBYSXdEaHlBTFNyQ3lqNjBGYkY3bGMrWDJ5aEZ3MVl1NkFSb1JwSUZqUGs0N2dQYitvbk55Wm1EM2hxY3c0emM3eVg4RVFCakQzeCtXTGY3Z2psRjZvTHJDM1ppV1VMWmQrdmJiS1FDN2I1WEI4cVhpT25TbXp5N2F5S21hOUpKL1lKRWlQbnNoczZEdzMwREk0UzhiYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6f8c7e5-be01-4a7e-976e-94678e3aac1e", "record_id": "flaws_cloudtrail:0000266:b6f8c7e5-be01-4a7e-976e-94678e3aac1e", "row_index": 266, "timestamp": "2019-03-26T16:32:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6f8c7e5-be01-4a7e-976e-94678e3aac1e", "eventTime": "2019-03-26T16:32:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTRW9mc2FhR2tKZ1EwTDdxUkQzOVY4Z2JCa2dJb1JMbGd6Qm5PQnBDdDBYSXdEaHlBTFNyQ3lqNjBGYkY3bGMrWDJ5aEZ3MVl1NkFSb1JwSUZqUGs0N2dQYitvbk55Wm1EM2hxY3c0emM3eVg4RVFCakQzeCtXTGY3Z2psRjZvTHJDM1ppV1VMWmQrdmJiS1FDN2I1WEI4cVhpT25TbXp5N2F5S21hOUpKL1lKRWlQbnNoczZEdzMwREk0UzhiYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcdaac1c-046e-4d79-9079-8e53397b265", "record_id": "flaws_cloudtrail:0000267:dcdaac1c-046e-4d79-9079-8e53397b265", "row_index": 267, "timestamp": "2019-03-26T16:32:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcdaac1c-046e-4d79-9079-8e53397b265", "eventTime": "2019-03-26T16:32:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSNXFBVWEyQ0NzSkNoYzBvdStxTkQrWWczaEZ0V2R2Q0g1bXl5cVVBQm82cnhrYnVaSjNzMFVUME0zTDNWMnVLZzBIaUd1T0lpRWpBbElwL3ZkbXVYeXkzTE9aU2FyaTNaL2tlOStrVXJQM3c2YWRGcG1UNFhGYWpHN1AwemFCMlVzZEpWSUd6TVowcUJ2R0lVK0xqQ1NqMitpSG9FSTd6UDBtU3JHaTZkMFhBQkJHakZ1cjFFNGh5dFJZM0IzVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef14a1f1-26ba-4cf8-bc4d-7dc77f9828a8", "record_id": "flaws_cloudtrail:0000268:ef14a1f1-26ba-4cf8-bc4d-7dc77f9828a8", "row_index": 268, "timestamp": "2019-03-26T16:32:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef14a1f1-26ba-4cf8-bc4d-7dc77f9828a8", "eventTime": "2019-03-26T16:32:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUN0NiQ201a0d3Mm16cFk1L3plZG81cTVnSXlYTXladGNOZVd3ZGJQWXJhOFc0dWc2azZKL0tMb001dUtjV2dXdjhYU3YrQ2h3dDd4NjJLZ2xnczVUeXgzVkFhT3JPYTZsMVNFdHhHY3lDeFZBV3pRUjdnbVhoZmlQSmxZMFBCZi9sYnVFTUJrS09XYTNFOG1PNlNHSGMxUThaazQwTGlMalp5WVcydTQxV0ZWbWZaTElNWWc5Z1h4RmdKaUFkQXYwZ0JVb3VFRjBJVThENXRaQTI5aFY5aHc0dHNWeWFvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcdaac1c-046e-4d79-9079-8e53397b265", "record_id": "flaws_cloudtrail:0000269:dcdaac1c-046e-4d79-9079-8e53397b265", "row_index": 269, "timestamp": "2019-03-26T16:32:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcdaac1c-046e-4d79-9079-8e53397b265", "eventTime": "2019-03-26T16:32:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSNXFBVWEyQ0NzSkNoYzBvdStxTkQrWWczaEZ0V2R2Q0g1bXl5cVVBQm82cnhrYnVaSjNzMFVUME0zTDNWMnVLZzBIaUd1T0lpRWpBbElwL3ZkbXVYeXkzTE9aU2FyaTNaL2tlOStrVXJQM3c2YWRGcG1UNFhGYWpHN1AwemFCMlVzZEpWSUd6TVowcUJ2R0lVK0xqQ1NqMitpSG9FSTd6UDBtU3JHaTZkMFhBQkJHakZ1cjFFNGh5dFJZM0IzVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef14a1f1-26ba-4cf8-bc4d-7dc77f9828a8", "record_id": "flaws_cloudtrail:0000270:ef14a1f1-26ba-4cf8-bc4d-7dc77f9828a8", "row_index": 270, "timestamp": "2019-03-26T16:32:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef14a1f1-26ba-4cf8-bc4d-7dc77f9828a8", "eventTime": "2019-03-26T16:32:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUN0NiQ201a0d3Mm16cFk1L3plZG81cTVnSXlYTXladGNOZVd3ZGJQWXJhOFc0dWc2azZKL0tMb001dUtjV2dXdjhYU3YrQ2h3dDd4NjJLZ2xnczVUeXgzVkFhT3JPYTZsMVNFdHhHY3lDeFZBV3pRUjdnbVhoZmlQSmxZMFBCZi9sYnVFTUJrS09XYTNFOG1PNlNHSGMxUThaazQwTGlMalp5WVcydTQxV0ZWbWZaTElNWWc5Z1h4RmdKaUFkQXYwZ0JVb3VFRjBJVThENXRaQTI5aFY5aHc0dHNWeWFvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae125e1e-59fa-4947-87aa-e279896c6e32", "record_id": "flaws_cloudtrail:0000271:ae125e1e-59fa-4947-87aa-e279896c6e32", "row_index": 271, "timestamp": "2019-03-26T16:32:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae125e1e-59fa-4947-87aa-e279896c6e32", "eventTime": "2019-03-26T16:32:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDVE9IQWdic2trR1kyMWR0RTRMaEdHUjd2TEYxTGtSMW1FaTg3NTRZQ3RTbkt3SERXQU9EMFVZTjBSbTZ6Nmk0c2I0MlBtbWlhenNpd2F3TnQrR1FndjJ0amkvSGVIWXRnRGRjSXB3MmtvcENIQWlpcUtGVzZKbG1Wam40dzQ1OExiUjBNSlg3KzZobCs0OGlHQmUvM2RlSUQ5YmQ1cGxVc0p1MTNJRnQ4VGlZMGl4bEpUQjBGcEwyMnFrTURYZU9ITEY5TUJ6MkZFQXFIb1Jra25Jd0tZN21KbDRMZHFrPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae125e1e-59fa-4947-87aa-e279896c6e32", "record_id": "flaws_cloudtrail:0000272:ae125e1e-59fa-4947-87aa-e279896c6e32", "row_index": 272, "timestamp": "2019-03-26T16:32:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1115, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae125e1e-59fa-4947-87aa-e279896c6e32", "eventTime": "2019-03-26T16:32:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDVE9IQWdic2trR1kyMWR0RTRMaEdHUjd2TEYxTGtSMW1FaTg3NTRZQ3RTbkt3SERXQU9EMFVZTjBSbTZ6Nmk0c2I0MlBtbWlhenNpd2F3TnQrR1FndjJ0amkvSGVIWXRnRGRjSXB3MmtvcENIQWlpcUtGVzZKbG1Wam40dzQ1OExiUjBNSlg3KzZobCs0OGlHQmUvM2RlSUQ5YmQ1cGxVc0p1MTNJRnQ4VGlZMGl4bEpUQjBGcEwyMnFrTURYZU9ITEY5TUJ6MkZFQXFIb1Jra25Jd0tZN21KbDRMZHFrPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc5f54f5-a452-424b-9c84-52dc2b9fd140", "record_id": "flaws_cloudtrail:0000273:fc5f54f5-a452-424b-9c84-52dc2b9fd140", "row_index": 273, "timestamp": "2019-03-26T16:32:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc5f54f5-a452-424b-9c84-52dc2b9fd140", "eventTime": "2019-03-26T16:32:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSbnN3ckdwN2RkNkFJcHRuZEhPTHp1Z0xBREFvZ0xucVBOVEt2RUgvRCtpUXBsUGdBenAwcERPWnZXdDladlgyanBpYytaeXVuYnBCYVhROVRzZGlVVTdldElxUzdwbkVnZDRIKzFmZUtldThpdWk5NG9LcTJZa21uN00vYm9aS3JXVDlBSUtBR2w0UDR3TWozNmtrNitKV1E2aUV3b0RJYkNidjdBK1dLNlJXcFZEOUpTaUhGNFBUbnFudUZqQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc5f54f5-a452-424b-9c84-52dc2b9fd140", "record_id": "flaws_cloudtrail:0000274:fc5f54f5-a452-424b-9c84-52dc2b9fd140", "row_index": 274, "timestamp": "2019-03-26T16:32:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc5f54f5-a452-424b-9c84-52dc2b9fd140", "eventTime": "2019-03-26T16:32:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSbnN3ckdwN2RkNkFJcHRuZEhPTHp1Z0xBREFvZ0xucVBOVEt2RUgvRCtpUXBsUGdBenAwcERPWnZXdDladlgyanBpYytaeXVuYnBCYVhROVRzZGlVVTdldElxUzdwbkVnZDRIKzFmZUtldThpdWk5NG9LcTJZa21uN00vYm9aS3JXVDlBSUtBR2w0UDR3TWozNmtrNitKV1E2aUV3b0RJYkNidjdBK1dLNlJXcFZEOUpTaUhGNFBUbnFudUZqQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "28c81ab9-f73a-4bae-a0c4-95c65e75b76f", "record_id": "flaws_cloudtrail:0000275:28c81ab9-f73a-4bae-a0c4-95c65e75b76f", "row_index": 275, "timestamp": "2019-03-26T16:32:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "28c81ab9-f73a-4bae-a0c4-95c65e75b76f", "eventTime": "2019-03-26T16:32:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYUkhBbTJHMENWaDU2TkJsZUdsUlh5SWsvTWFoUmp1d1J6R0lialcwNTQ5KzNHNmNKVnU2Sll0bXkrKzRuUGI4L0x3SmlWbGQwZ3UwVitkMFNUaWFwanBad043YjdUWUhQeTUvUE5uRlpUUGJDaG1pZjJnV0JvQXUvb29hd2dHZWpkSHBrU0doTGxUd2pjZXZaaEZ1b2VPUjBHWTZSc2IwUjJ3K0dsMUVwcWVIZk9qMkswWTNaRU0xNDNOUUFYVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b8ace77-c199-4a22-bb00-00af84789", "record_id": "flaws_cloudtrail:0000276:7b8ace77-c199-4a22-bb00-00af84789", "row_index": 276, "timestamp": "2019-03-26T16:32:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1112, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b8ace77-c199-4a22-bb00-00af84789", "eventTime": "2019-03-26T16:32:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpVUF6TnAwaW56OGxiU2x3S1ZuQ0FpN01zMUltUHgyR0pWVjRKR1owV0tETWRIWmpQNk9ZT1hQYXg2VlJMRXp3d0dwY2Ztb3gyVGo4QlNwTFlVWW4xNWMzTVpiK0tOSHdCVytzbmt6Sk1EZWhLZ25LNExhdXV2SElTS1J3U09tUkZUNXhYT01aTnB5amsyTDVVbCtPRk96ZHh5aEx4RDFlVjU4Y2YzNWpkQlArY0ZqR2Vtd01oeDRWdVFrZ0dzL25WaVFIYUxRbXRjZDdPdHlOL2h6NWpqVDdKc1Z1V3BFPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "28c81ab9-f73a-4bae-a0c4-95c65e75b76f", "record_id": "flaws_cloudtrail:0000277:28c81ab9-f73a-4bae-a0c4-95c65e75b76f", "row_index": 277, "timestamp": "2019-03-26T16:32:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "28c81ab9-f73a-4bae-a0c4-95c65e75b76f", "eventTime": "2019-03-26T16:32:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYUkhBbTJHMENWaDU2TkJsZUdsUlh5SWsvTWFoUmp1d1J6R0lialcwNTQ5KzNHNmNKVnU2Sll0bXkrKzRuUGI4L0x3SmlWbGQwZ3UwVitkMFNUaWFwanBad043YjdUWUhQeTUvUE5uRlpUUGJDaG1pZjJnV0JvQXUvb29hd2dHZWpkSHBrU0doTGxUd2pjZXZaaEZ1b2VPUjBHWTZSc2IwUjJ3K0dsMUVwcWVIZk9qMkswWTNaRU0xNDNOUUFYVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b8ace77-c199-4a22-bb00-00af84789", "record_id": "flaws_cloudtrail:0000278:7b8ace77-c199-4a22-bb00-00af84789", "row_index": 278, "timestamp": "2019-03-26T16:32:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1112, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b8ace77-c199-4a22-bb00-00af84789", "eventTime": "2019-03-26T16:32:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpVUF6TnAwaW56OGxiU2x3S1ZuQ0FpN01zMUltUHgyR0pWVjRKR1owV0tETWRIWmpQNk9ZT1hQYXg2VlJMRXp3d0dwY2Ztb3gyVGo4QlNwTFlVWW4xNWMzTVpiK0tOSHdCVytzbmt6Sk1EZWhLZ25LNExhdXV2SElTS1J3U09tUkZUNXhYT01aTnB5amsyTDVVbCtPRk96ZHh5aEx4RDFlVjU4Y2YzNWpkQlArY0ZqR2Vtd01oeDRWdVFrZ0dzL25WaVFIYUxRbXRjZDdPdHlOL2h6NWpqVDdKc1Z1V3BFPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31e19a4f-0e45-4244-8b4b-d95385824ff5", "record_id": "flaws_cloudtrail:0000279:31e19a4f-0e45-4244-8b4b-d95385824ff5", "row_index": 279, "timestamp": "2019-03-26T16:39:28Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31e19a4f-0e45-4244-8b4b-d95385824ff5", "eventTime": "2019-03-26T16:39:28Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31e19a4f-0e45-4244-8b4b-d95385824ff5", "record_id": "flaws_cloudtrail:0000280:31e19a4f-0e45-4244-8b4b-d95385824ff5", "row_index": 280, "timestamp": "2019-03-26T16:39:28Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31e19a4f-0e45-4244-8b4b-d95385824ff5", "eventTime": "2019-03-26T16:39:28Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17c4c642-7575-4723-8214-ed0ebda74224", "record_id": "flaws_cloudtrail:0000281:17c4c642-7575-4723-8214-ed0ebda74224", "row_index": 281, "timestamp": "2019-03-26T16:52:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17c4c642-7575-4723-8214-ed0ebda74224", "eventTime": "2019-03-26T16:52:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17c4c642-7575-4723-8214-ed0ebda74224", "record_id": "flaws_cloudtrail:0000282:17c4c642-7575-4723-8214-ed0ebda74224", "row_index": 282, "timestamp": "2019-03-26T16:52:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17c4c642-7575-4723-8214-ed0ebda74224", "eventTime": "2019-03-26T16:52:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25b3b444-0ab4-43c6-bb78-6a4c2d0a4c7d", "record_id": "flaws_cloudtrail:0000283:25b3b444-0ab4-43c6-bb78-6a4c2d0a4c7d", "row_index": 283, "timestamp": "2019-03-26T16:52:45Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25b3b444-0ab4-43c6-bb78-6a4c2d0a4c7d", "eventTime": "2019-03-26T16:52:45Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25b3b444-0ab4-43c6-bb78-6a4c2d0a4c7d", "record_id": "flaws_cloudtrail:0000284:25b3b444-0ab4-43c6-bb78-6a4c2d0a4c7d", "row_index": 284, "timestamp": "2019-03-26T16:52:45Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25b3b444-0ab4-43c6-bb78-6a4c2d0a4c7d", "eventTime": "2019-03-26T16:52:45Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f5e210d-49b7-4808-ab9a-28ff89a5127a", "record_id": "flaws_cloudtrail:0000285:6f5e210d-49b7-4808-ab9a-28ff89a5127a", "row_index": 285, "timestamp": "2019-03-26T16:53:00Z", "event_type": "GetConsoleOutput", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f5e210d-49b7-4808-ab9a-28ff89a5127a", "eventTime": "2019-03-26T16:53:00Z", "eventName": "GetConsoleOutput", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f5e210d-49b7-4808-ab9a-28ff89a5127a", "record_id": "flaws_cloudtrail:0000286:6f5e210d-49b7-4808-ab9a-28ff89a5127a", "row_index": 286, "timestamp": "2019-03-26T16:53:00Z", "event_type": "GetConsoleOutput", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f5e210d-49b7-4808-ab9a-28ff89a5127a", "eventTime": "2019-03-26T16:53:00Z", "eventName": "GetConsoleOutput", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc0e1119-f4a9-4cb1-998f-b27b574ac5cd", "record_id": "flaws_cloudtrail:0000287:bc0e1119-f4a9-4cb1-998f-b27b574ac5cd", "row_index": 287, "timestamp": "2019-03-26T16:54:50Z", "event_type": "DescribeIamInstanceProfileAssociations", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc0e1119-f4a9-4cb1-998f-b27b574ac5cd", "eventTime": "2019-03-26T16:54:50Z", "eventName": "DescribeIamInstanceProfileAssociations", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"DescribeIamInstanceProfileAssociationsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc0e1119-f4a9-4cb1-998f-b27b574ac5cd", "record_id": "flaws_cloudtrail:0000288:bc0e1119-f4a9-4cb1-998f-b27b574ac5cd", "row_index": 288, "timestamp": "2019-03-26T16:54:50Z", "event_type": "DescribeIamInstanceProfileAssociations", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc0e1119-f4a9-4cb1-998f-b27b574ac5cd", "eventTime": "2019-03-26T16:54:50Z", "eventName": "DescribeIamInstanceProfileAssociations", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"DescribeIamInstanceProfileAssociationsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6db04f6f-75e5-491c-95e5-4f11c43ce1f1", "record_id": "flaws_cloudtrail:0000289:6db04f6f-75e5-491c-95e5-4f11c43ce1f1", "row_index": 289, "timestamp": "2019-03-26T17:01:36Z", "event_type": "MonitorInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 856, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6db04f6f-75e5-491c-95e5-4f11c43ce1f1", "eventTime": "2019-03-26T17:01:36Z", "eventName": "MonitorInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {"items": [{"instanceId": "i-aa2d3b42e5c6e801a"}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6db04f6f-75e5-491c-95e5-4f11c43ce1f1", "record_id": "flaws_cloudtrail:0000290:6db04f6f-75e5-491c-95e5-4f11c43ce1f1", "row_index": 290, "timestamp": "2019-03-26T17:01:36Z", "event_type": "MonitorInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 856, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6db04f6f-75e5-491c-95e5-4f11c43ce1f1", "eventTime": "2019-03-26T17:01:36Z", "eventName": "MonitorInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {"items": [{"instanceId": "i-aa2d3b42e5c6e801a"}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b027238e6-5b63-478a-a9f3-ce54a60974d", "record_id": "flaws_cloudtrail:0000291:b027238e6-5b63-478a-a9f3-ce54a60974d", "row_index": 291, "timestamp": "2019-03-26T17:03:10Z", "event_type": "GetPasswordData", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b027238e6-5b63-478a-a9f3-ce54a60974d", "eventTime": "2019-03-26T17:03:10Z", "eventName": "GetPasswordData", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b027238e6-5b63-478a-a9f3-ce54a60974d", "record_id": "flaws_cloudtrail:0000292:b027238e6-5b63-478a-a9f3-ce54a60974d", "row_index": 292, "timestamp": "2019-03-26T17:03:10Z", "event_type": "GetPasswordData", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b027238e6-5b63-478a-a9f3-ce54a60974d", "eventTime": "2019-03-26T17:03:10Z", "eventName": "GetPasswordData", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b330bbd0-5a31-4fe1-8d78-84051f8ed0a1", "record_id": "flaws_cloudtrail:0000293:b330bbd0-5a31-4fe1-8d78-84051f8ed0a1", "row_index": 293, "timestamp": "2019-03-26T17:04:05Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b330bbd0-5a31-4fe1-8d78-84051f8ed0a1", "eventTime": "2019-03-26T17:04:05Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxResults": 1000, "volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b330bbd0-5a31-4fe1-8d78-84051f8ed0a1", "record_id": "flaws_cloudtrail:0000294:b330bbd0-5a31-4fe1-8d78-84051f8ed0a1", "row_index": 294, "timestamp": "2019-03-26T17:04:05Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b330bbd0-5a31-4fe1-8d78-84051f8ed0a1", "eventTime": "2019-03-26T17:04:05Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxResults": 1000, "volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ef883b7-be59-4ed5-9eb0-0b71c1ac69cb", "record_id": "flaws_cloudtrail:0000295:0ef883b7-be59-4ed5-9eb0-0b71c1ac69cb", "row_index": 295, "timestamp": "2019-03-26T17:06:59Z", "event_type": "DescribePrincipalIdFormat", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ef883b7-be59-4ed5-9eb0-0b71c1ac69cb", "eventTime": "2019-03-26T17:06:59Z", "eventName": "DescribePrincipalIdFormat", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"DescribePrincipalIdFormatRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ef883b7-be59-4ed5-9eb0-0b71c1ac69cb", "record_id": "flaws_cloudtrail:0000296:0ef883b7-be59-4ed5-9eb0-0b71c1ac69cb", "row_index": 296, "timestamp": "2019-03-26T17:06:59Z", "event_type": "DescribePrincipalIdFormat", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ef883b7-be59-4ed5-9eb0-0b71c1ac69cb", "eventTime": "2019-03-26T17:06:59Z", "eventName": "DescribePrincipalIdFormat", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"DescribePrincipalIdFormatRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac318254-caea-408f-9851-13461ccc13ec", "record_id": "flaws_cloudtrail:0000297:ac318254-caea-408f-9851-13461ccc13ec", "row_index": 297, "timestamp": "2019-03-26T17:08:29Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac318254-caea-408f-9851-13461ccc13ec", "eventTime": "2019-03-26T17:08:29Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac318254-caea-408f-9851-13461ccc13ec", "record_id": "flaws_cloudtrail:0000298:ac318254-caea-408f-9851-13461ccc13ec", "row_index": 298, "timestamp": "2019-03-26T17:08:29Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac318254-caea-408f-9851-13461ccc13ec", "eventTime": "2019-03-26T17:08:29Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65a60760-f2d9-4964-9ac6-326fecdef476", "record_id": "flaws_cloudtrail:0000299:65a60760-f2d9-4964-9ac6-326fecdef476", "row_index": 299, "timestamp": "2019-03-26T17:09:59Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIAYMJWHMFGNAUBOBH9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65a60760-f2d9-4964-9ac6-326fecdef476", "eventTime": "2019-03-26T17:09:59Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIAYMJWHMFGNAUBOBH9", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:09:59Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65a60760-f2d9-4964-9ac6-326fecdef476", "record_id": "flaws_cloudtrail:0000300:65a60760-f2d9-4964-9ac6-326fecdef476", "row_index": 300, "timestamp": "2019-03-26T17:09:59Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIAYMJWHMFGNAUBOBH9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65a60760-f2d9-4964-9ac6-326fecdef476", "eventTime": "2019-03-26T17:09:59Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIAYMJWHMFGNAUBOBH9", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:09:59Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "263c7890-6db5-4da6-978e-581339d04f0d", "record_id": "flaws_cloudtrail:0000301:263c7890-6db5-4da6-978e-581339d04f0d", "row_index": 301, "timestamp": "2019-03-26T17:17:29Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 679, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "263c7890-6db5-4da6-978e-581339d04f0d", "eventTime": "2019-03-26T17:17:29Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "263c7890-6db5-4da6-978e-581339d04f0d", "record_id": "flaws_cloudtrail:0000302:263c7890-6db5-4da6-978e-581339d04f0d", "row_index": 302, "timestamp": "2019-03-26T17:17:29Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 679, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "263c7890-6db5-4da6-978e-581339d04f0d", "eventTime": "2019-03-26T17:17:29Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40b36db1-43aa-4924-9315-bd328a71a6e3", "record_id": "flaws_cloudtrail:0000303:40b36db1-43aa-4924-9315-bd328a71a6e3", "row_index": 303, "timestamp": "2019-03-26T17:17:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40b36db1-43aa-4924-9315-bd328a71a6e3", "eventTime": "2019-03-26T17:17:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40b36db1-43aa-4924-9315-bd328a71a6e3", "record_id": "flaws_cloudtrail:0000304:40b36db1-43aa-4924-9315-bd328a71a6e3", "row_index": 304, "timestamp": "2019-03-26T17:17:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40b36db1-43aa-4924-9315-bd328a71a6e3", "eventTime": "2019-03-26T17:17:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4657dfb-49e1-4abf-a09d-b6cccce0d2ca", "record_id": "flaws_cloudtrail:0000305:a4657dfb-49e1-4abf-a09d-b6cccce0d2ca", "row_index": 305, "timestamp": "2019-03-26T17:17:50Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4657dfb-49e1-4abf-a09d-b6cccce0d2ca", "eventTime": "2019-03-26T17:17:50Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACeu7UZBmiiCGUU9XAcRx04XQQO3LPAuwROKKvd8E98TJqVpIE6s/6Mq7C7Up6MxXUBcG1oTtf4S9bOc4Baf6/gcxX1PoTzftmZGaCl1QCZGRw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ac3bbf5-643d-414f-be7e-39168ca8ff1c", "record_id": "flaws_cloudtrail:0000306:5ac3bbf5-643d-414f-be7e-39168ca8ff1c", "row_index": 306, "timestamp": "2019-03-26T17:17:50Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ac3bbf5-643d-414f-be7e-39168ca8ff1c", "eventTime": "2019-03-26T17:17:50Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ADIRQzeI30/Z3iZvDePV3JUx4QiV9b9PxD6/misPf5fBGA+XWeWR1cspo90oGMyb4rmFuGUvlWv7y7VfOOJWuiGsy6x7DHYOtrgcJYBrX0M0/Q==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4657dfb-49e1-4abf-a09d-b6cccce0d2ca", "record_id": "flaws_cloudtrail:0000307:a4657dfb-49e1-4abf-a09d-b6cccce0d2ca", "row_index": 307, "timestamp": "2019-03-26T17:17:50Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4657dfb-49e1-4abf-a09d-b6cccce0d2ca", "eventTime": "2019-03-26T17:17:50Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACeu7UZBmiiCGUU9XAcRx04XQQO3LPAuwROKKvd8E98TJqVpIE6s/6Mq7C7Up6MxXUBcG1oTtf4S9bOc4Baf6/gcxX1PoTzftmZGaCl1QCZGRw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ac3bbf5-643d-414f-be7e-39168ca8ff1c", "record_id": "flaws_cloudtrail:0000308:5ac3bbf5-643d-414f-be7e-39168ca8ff1c", "row_index": 308, "timestamp": "2019-03-26T17:17:50Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ac3bbf5-643d-414f-be7e-39168ca8ff1c", "eventTime": "2019-03-26T17:17:50Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ADIRQzeI30/Z3iZvDePV3JUx4QiV9b9PxD6/misPf5fBGA+XWeWR1cspo90oGMyb4rmFuGUvlWv7y7VfOOJWuiGsy6x7DHYOtrgcJYBrX0M0/Q==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7e224b6-4564-440a-b34c-679d3f32b224", "record_id": "flaws_cloudtrail:0000309:b7e224b6-4564-440a-b34c-679d3f32b224", "row_index": 309, "timestamp": "2019-03-26T17:17:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7e224b6-4564-440a-b34c-679d3f32b224", "eventTime": "2019-03-26T17:17:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACZ5M5gyc1clLrcJSaxSnt/a2PwGgYheKfmF/oDcGhbLyqZ9CON0fcYiC93DpAl174y/P3OBCbZL6GSg3LoYiiAPWlXf22t9G+drJ4oOk4krgw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b025fe3a-28cd-4337-8ab9-15634f7cd6d2", "record_id": "flaws_cloudtrail:0000310:b025fe3a-28cd-4337-8ab9-15634f7cd6d2", "row_index": 310, "timestamp": "2019-03-26T17:17:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b025fe3a-28cd-4337-8ab9-15634f7cd6d2", "eventTime": "2019-03-26T17:17:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AAm6e99/R4G4CoyCCjAlTK6XVmDUXNMAkXCYiR34fXczxh0kUxsyW2pqkOA7xxJVbb42ZlEbMi63nJRM+9qYIdHaS8KjJ86M/X6vksz0icqnzw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "420867b-35b6-45ed-9fdd-48760d698059", "record_id": "flaws_cloudtrail:0000311:420867b-35b6-45ed-9fdd-48760d698059", "row_index": 311, "timestamp": "2019-03-26T17:17:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "420867b-35b6-45ed-9fdd-48760d698059", "eventTime": "2019-03-26T17:17:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC7/PGM+abkcr5LD5I1rtXDmKf2SMc5v24Hz19SNgyEnsR1pSq9HSufZ4DGPw7B7LAlCjh6mV1xQ42X/yD7U78ImvDFmpa21t+rDl+sbCvmlkA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7e224b6-4564-440a-b34c-679d3f32b224", "record_id": "flaws_cloudtrail:0000312:b7e224b6-4564-440a-b34c-679d3f32b224", "row_index": 312, "timestamp": "2019-03-26T17:17:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7e224b6-4564-440a-b34c-679d3f32b224", "eventTime": "2019-03-26T17:17:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACZ5M5gyc1clLrcJSaxSnt/a2PwGgYheKfmF/oDcGhbLyqZ9CON0fcYiC93DpAl174y/P3OBCbZL6GSg3LoYiiAPWlXf22t9G+drJ4oOk4krgw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b025fe3a-28cd-4337-8ab9-15634f7cd6d2", "record_id": "flaws_cloudtrail:0000313:b025fe3a-28cd-4337-8ab9-15634f7cd6d2", "row_index": 313, "timestamp": "2019-03-26T17:17:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b025fe3a-28cd-4337-8ab9-15634f7cd6d2", "eventTime": "2019-03-26T17:17:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AAm6e99/R4G4CoyCCjAlTK6XVmDUXNMAkXCYiR34fXczxh0kUxsyW2pqkOA7xxJVbb42ZlEbMi63nJRM+9qYIdHaS8KjJ86M/X6vksz0icqnzw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "420867b-35b6-45ed-9fdd-48760d698059", "record_id": "flaws_cloudtrail:0000314:420867b-35b6-45ed-9fdd-48760d698059", "row_index": 314, "timestamp": "2019-03-26T17:17:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "420867b-35b6-45ed-9fdd-48760d698059", "eventTime": "2019-03-26T17:17:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC7/PGM+abkcr5LD5I1rtXDmKf2SMc5v24Hz19SNgyEnsR1pSq9HSufZ4DGPw7B7LAlCjh6mV1xQ42X/yD7U78ImvDFmpa21t+rDl+sbCvmlkA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9df2ac33-e7a8-4e1f-bf51-f088f007243", "record_id": "flaws_cloudtrail:0000315:9df2ac33-e7a8-4e1f-bf51-f088f007243", "row_index": 315, "timestamp": "2019-03-26T17:18:20Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9df2ac33-e7a8-4e1f-bf51-f088f007243", "eventTime": "2019-03-26T17:18:20Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABCfFZ8WASMEnfbDjeaDBQQSJG+N+xt6b5KlkdS5/QBBlnWFbcIgXsbFmKCeLp+EuTv3kcj7WaApd3UtSdZ4DAIxirM9UzpET0el4+qHW5LaHA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "322850ec0-6333-4a83-b3f0-7d61c52438ed", "record_id": "flaws_cloudtrail:0000316:322850ec0-6333-4a83-b3f0-7d61c52438ed", "row_index": 316, "timestamp": "2019-03-26T17:18:20Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "322850ec0-6333-4a83-b3f0-7d61c52438ed", "eventTime": "2019-03-26T17:18:20Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9df2ac33-e7a8-4e1f-bf51-f088f007243", "record_id": "flaws_cloudtrail:0000317:9df2ac33-e7a8-4e1f-bf51-f088f007243", "row_index": 317, "timestamp": "2019-03-26T17:18:20Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9df2ac33-e7a8-4e1f-bf51-f088f007243", "eventTime": "2019-03-26T17:18:20Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABCfFZ8WASMEnfbDjeaDBQQSJG+N+xt6b5KlkdS5/QBBlnWFbcIgXsbFmKCeLp+EuTv3kcj7WaApd3UtSdZ4DAIxirM9UzpET0el4+qHW5LaHA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "322850ec0-6333-4a83-b3f0-7d61c52438ed", "record_id": "flaws_cloudtrail:0000318:322850ec0-6333-4a83-b3f0-7d61c52438ed", "row_index": 318, "timestamp": "2019-03-26T17:18:20Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "322850ec0-6333-4a83-b3f0-7d61c52438ed", "eventTime": "2019-03-26T17:18:20Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bd500f8-06e9-45ca-9ba0-5a745abb6e1e", "record_id": "flaws_cloudtrail:0000319:6bd500f8-06e9-45ca-9ba0-5a745abb6e1e", "row_index": 319, "timestamp": "2019-03-26T17:18:21Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bd500f8-06e9-45ca-9ba0-5a745abb6e1e", "eventTime": "2019-03-26T17:18:21Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABsEwBcyQDtZf2yW+nptpTCcGlLlOs6YqhI29tAUcFxx/kGfX+hIfZgDVKDxr1hZngHUkr6yaGpzNwVO38Ek2KR5+eP6BBGe18My/yv+KCQ+cQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be9c5dde-00cf-44c1-8eda-761072b7785c", "record_id": "flaws_cloudtrail:0000320:be9c5dde-00cf-44c1-8eda-761072b7785c", "row_index": 320, "timestamp": "2019-03-26T17:18:21Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be9c5dde-00cf-44c1-8eda-761072b7785c", "eventTime": "2019-03-26T17:18:21Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC5XGI06J3c8NsVwR4I8ewKUu6KLbgn25wQ9hRDmGhPP/Z5F4sTaWfan2znePfAWF3l5Vs8+9pKEneANYctnNzxMWW+I6xK9kOf8akTkxf7RZA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35a88e4f-f307-42ef-9dde-72b18984b903", "record_id": "flaws_cloudtrail:0000321:35a88e4f-f307-42ef-9dde-72b18984b903", "row_index": 321, "timestamp": "2019-03-26T17:18:21Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35a88e4f-f307-42ef-9dde-72b18984b903", "eventTime": "2019-03-26T17:18:21Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AAKA+u5h2ifpYfvzruDiXJsOVR5njNZ1wb31JdDqcyz3WyalacISrtbH4JyZ/jiNOrS5baAmQ2UA0NeqHHaxX+S19Pu9uRr6IuIFg8r7CBVUSg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bd500f8-06e9-45ca-9ba0-5a745abb6e1e", "record_id": "flaws_cloudtrail:0000322:6bd500f8-06e9-45ca-9ba0-5a745abb6e1e", "row_index": 322, "timestamp": "2019-03-26T17:18:21Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bd500f8-06e9-45ca-9ba0-5a745abb6e1e", "eventTime": "2019-03-26T17:18:21Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABsEwBcyQDtZf2yW+nptpTCcGlLlOs6YqhI29tAUcFxx/kGfX+hIfZgDVKDxr1hZngHUkr6yaGpzNwVO38Ek2KR5+eP6BBGe18My/yv+KCQ+cQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be9c5dde-00cf-44c1-8eda-761072b7785c", "record_id": "flaws_cloudtrail:0000323:be9c5dde-00cf-44c1-8eda-761072b7785c", "row_index": 323, "timestamp": "2019-03-26T17:18:21Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be9c5dde-00cf-44c1-8eda-761072b7785c", "eventTime": "2019-03-26T17:18:21Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC5XGI06J3c8NsVwR4I8ewKUu6KLbgn25wQ9hRDmGhPP/Z5F4sTaWfan2znePfAWF3l5Vs8+9pKEneANYctnNzxMWW+I6xK9kOf8akTkxf7RZA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35a88e4f-f307-42ef-9dde-72b18984b903", "record_id": "flaws_cloudtrail:0000324:35a88e4f-f307-42ef-9dde-72b18984b903", "row_index": 324, "timestamp": "2019-03-26T17:18:21Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35a88e4f-f307-42ef-9dde-72b18984b903", "eventTime": "2019-03-26T17:18:21Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AAKA+u5h2ifpYfvzruDiXJsOVR5njNZ1wb31JdDqcyz3WyalacISrtbH4JyZ/jiNOrS5baAmQ2UA0NeqHHaxX+S19Pu9uRr6IuIFg8r7CBVUSg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42f29cf5-e227-4884-81ba-f7fa072d4f29", "record_id": "flaws_cloudtrail:0000325:42f29cf5-e227-4884-81ba-f7fa072d4f29", "row_index": 325, "timestamp": "2019-03-26T17:18:22Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42f29cf5-e227-4884-81ba-f7fa072d4f29", "eventTime": "2019-03-26T17:18:22Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC9fpghlGqYk/uKUTAEF1oN/1MTUkrXnDgb8lUTn9DEA+YGfNRkBmhpJe+MHf9lBm1egAJZ+5AMMknAMrHLjf5jLBV+jFcs28VZFUtML2QXL7w==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42f29cf5-e227-4884-81ba-f7fa072d4f29", "record_id": "flaws_cloudtrail:0000326:42f29cf5-e227-4884-81ba-f7fa072d4f29", "row_index": 326, "timestamp": "2019-03-26T17:18:22Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42f29cf5-e227-4884-81ba-f7fa072d4f29", "eventTime": "2019-03-26T17:18:22Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC9fpghlGqYk/uKUTAEF1oN/1MTUkrXnDgb8lUTn9DEA+YGfNRkBmhpJe+MHf9lBm1egAJZ+5AMMknAMrHLjf5jLBV+jFcs28VZFUtML2QXL7w==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "772feba7-1b39-4e94-95ba-39a31b42d9ca", "record_id": "flaws_cloudtrail:0000327:772feba7-1b39-4e94-95ba-39a31b42d9ca", "row_index": 327, "timestamp": "2019-03-26T17:20:14Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "772feba7-1b39-4e94-95ba-39a31b42d9ca", "eventTime": "2019-03-26T17:20:14Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "772feba7-1b39-4e94-95ba-39a31b42d9ca", "record_id": "flaws_cloudtrail:0000328:772feba7-1b39-4e94-95ba-39a31b42d9ca", "row_index": 328, "timestamp": "2019-03-26T17:20:14Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "772feba7-1b39-4e94-95ba-39a31b42d9ca", "eventTime": "2019-03-26T17:20:14Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80ee537f-78ae-41e2-9d89-2a97d59820ad", "record_id": "flaws_cloudtrail:0000329:80ee537f-78ae-41e2-9d89-2a97d59820ad", "row_index": 329, "timestamp": "2019-03-26T17:23:05Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 678, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80ee537f-78ae-41e2-9d89-2a97d59820ad", "eventTime": "2019-03-26T17:23:05Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80ee537f-78ae-41e2-9d89-2a97d59820ad", "record_id": "flaws_cloudtrail:0000330:80ee537f-78ae-41e2-9d89-2a97d59820ad", "row_index": 330, "timestamp": "2019-03-26T17:23:05Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 678, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80ee537f-78ae-41e2-9d89-2a97d59820ad", "eventTime": "2019-03-26T17:23:05Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11cdce7e-eac7-4666-a96e-e0ac97805fe6", "record_id": "flaws_cloudtrail:0000331:11cdce7e-eac7-4666-a96e-e0ac97805fe6", "row_index": 331, "timestamp": "2019-03-26T17:27:16Z", "event_type": "DescribeInstanceAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11cdce7e-eac7-4666-a96e-e0ac97805fe6", "eventTime": "2019-03-26T17:27:16Z", "eventName": "DescribeInstanceAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a", "attribute": "userData"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11cdce7e-eac7-4666-a96e-e0ac97805fe6", "record_id": "flaws_cloudtrail:0000332:11cdce7e-eac7-4666-a96e-e0ac97805fe6", "row_index": 332, "timestamp": "2019-03-26T17:27:16Z", "event_type": "DescribeInstanceAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11cdce7e-eac7-4666-a96e-e0ac97805fe6", "eventTime": "2019-03-26T17:27:16Z", "eventName": "DescribeInstanceAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a", "attribute": "userData"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f81744-64ee-4a01-83e6-948d088828a25", "record_id": "flaws_cloudtrail:0000333:f81744-64ee-4a01-83e6-948d088828a25", "row_index": 333, "timestamp": "2019-03-26T17:28:01Z", "event_type": "DescribeInstanceAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f81744-64ee-4a01-83e6-948d088828a25", "eventTime": "2019-03-26T17:28:01Z", "eventName": "DescribeInstanceAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a", "attribute": "groupSet"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f81744-64ee-4a01-83e6-948d088828a25", "record_id": "flaws_cloudtrail:0000334:f81744-64ee-4a01-83e6-948d088828a25", "row_index": 334, "timestamp": "2019-03-26T17:28:01Z", "event_type": "DescribeInstanceAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f81744-64ee-4a01-83e6-948d088828a25", "eventTime": "2019-03-26T17:28:01Z", "eventName": "DescribeInstanceAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a", "attribute": "groupSet"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "525f1bc0-8615-4af3-a423-74f8e1627c46", "record_id": "flaws_cloudtrail:0000335:525f1bc0-8615-4af3-a423-74f8e1627c46", "row_index": 335, "timestamp": "2019-03-26T17:32:33Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "525f1bc0-8615-4af3-a423-74f8e1627c46", "eventTime": "2019-03-26T17:32:33Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC8azOo3OSKGvdMp7XHyUws/5kjtM6KnXQmUxjMLImMJMGX1e8iqcgG7/smom98WnFkGNYMXOFAzvUUaXY3QcvT9Q+EAvYCCFCCAj5mrmoL45w==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0edc3c9f-6e9c-4a9a-9c7a-0a08d47740dc", "record_id": "flaws_cloudtrail:0000336:0edc3c9f-6e9c-4a9a-9c7a-0a08d47740dc", "row_index": 336, "timestamp": "2019-03-26T17:32:33Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0edc3c9f-6e9c-4a9a-9c7a-0a08d47740dc", "eventTime": "2019-03-26T17:32:33Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "525f1bc0-8615-4af3-a423-74f8e1627c46", "record_id": "flaws_cloudtrail:0000337:525f1bc0-8615-4af3-a423-74f8e1627c46", "row_index": 337, "timestamp": "2019-03-26T17:32:33Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "525f1bc0-8615-4af3-a423-74f8e1627c46", "eventTime": "2019-03-26T17:32:33Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC8azOo3OSKGvdMp7XHyUws/5kjtM6KnXQmUxjMLImMJMGX1e8iqcgG7/smom98WnFkGNYMXOFAzvUUaXY3QcvT9Q+EAvYCCFCCAj5mrmoL45w==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0edc3c9f-6e9c-4a9a-9c7a-0a08d47740dc", "record_id": "flaws_cloudtrail:0000338:0edc3c9f-6e9c-4a9a-9c7a-0a08d47740dc", "row_index": 338, "timestamp": "2019-03-26T17:32:33Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0edc3c9f-6e9c-4a9a-9c7a-0a08d47740dc", "eventTime": "2019-03-26T17:32:33Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25336-5ba1-47b3-b79a-e16bcedfeb1e", "record_id": "flaws_cloudtrail:0000339:25336-5ba1-47b3-b79a-e16bcedfeb1e", "row_index": 339, "timestamp": "2019-03-26T17:32:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25336-5ba1-47b3-b79a-e16bcedfeb1e", "eventTime": "2019-03-26T17:32:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACGwVjtgkl5hnzan73bLx5iOrAjhi/ak5KPwCngpaMwogBgUCU3HsXdvdVhY7bjlFFfplrV1tcgmrIO8MGrAKh002vI7rGu5SL7dmjmBKPbr7A==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69f7c93f-0eca-45b4-82f2-1064c8e88d81", "record_id": "flaws_cloudtrail:0000340:69f7c93f-0eca-45b4-82f2-1064c8e88d81", "row_index": 340, "timestamp": "2019-03-26T17:32:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69f7c93f-0eca-45b4-82f2-1064c8e88d81", "eventTime": "2019-03-26T17:32:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABCQYLFm1w17KAQMNOTaH7vE3uB9B1d0P+9G9lFPs08/ArCXmORje5Uy635GyYITDrnfd1nQ68wVXiLEkObs5OhL/7gT5RH7JvD8CWds1IU1UA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "504150abf-2ec9-4947-86d8-10244c9cf5f", "record_id": "flaws_cloudtrail:0000341:504150abf-2ec9-4947-86d8-10244c9cf5f", "row_index": 341, "timestamp": "2019-03-26T17:32:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "504150abf-2ec9-4947-86d8-10244c9cf5f", "eventTime": "2019-03-26T17:32:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACTQ9E13FRS3W5EIzY1Ndd/Wk352dDOuEAKXt4TCc1vI6u8kp1y3NWGa3lKsOHHMmWgvxG588uXEW40Bwd2fC78r6vj7yoLsaNnbzBIKVCXukg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25336-5ba1-47b3-b79a-e16bcedfeb1e", "record_id": "flaws_cloudtrail:0000342:25336-5ba1-47b3-b79a-e16bcedfeb1e", "row_index": 342, "timestamp": "2019-03-26T17:32:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25336-5ba1-47b3-b79a-e16bcedfeb1e", "eventTime": "2019-03-26T17:32:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACGwVjtgkl5hnzan73bLx5iOrAjhi/ak5KPwCngpaMwogBgUCU3HsXdvdVhY7bjlFFfplrV1tcgmrIO8MGrAKh002vI7rGu5SL7dmjmBKPbr7A==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69f7c93f-0eca-45b4-82f2-1064c8e88d81", "record_id": "flaws_cloudtrail:0000343:69f7c93f-0eca-45b4-82f2-1064c8e88d81", "row_index": 343, "timestamp": "2019-03-26T17:32:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69f7c93f-0eca-45b4-82f2-1064c8e88d81", "eventTime": "2019-03-26T17:32:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABCQYLFm1w17KAQMNOTaH7vE3uB9B1d0P+9G9lFPs08/ArCXmORje5Uy635GyYITDrnfd1nQ68wVXiLEkObs5OhL/7gT5RH7JvD8CWds1IU1UA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "504150abf-2ec9-4947-86d8-10244c9cf5f", "record_id": "flaws_cloudtrail:0000344:504150abf-2ec9-4947-86d8-10244c9cf5f", "row_index": 344, "timestamp": "2019-03-26T17:32:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "504150abf-2ec9-4947-86d8-10244c9cf5f", "eventTime": "2019-03-26T17:32:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACTQ9E13FRS3W5EIzY1Ndd/Wk352dDOuEAKXt4TCc1vI6u8kp1y3NWGa3lKsOHHMmWgvxG588uXEW40Bwd2fC78r6vj7yoLsaNnbzBIKVCXukg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "940bea5b-7859-430b-b826-e970e18047a", "record_id": "flaws_cloudtrail:0000345:940bea5b-7859-430b-b826-e970e18047a", "row_index": 345, "timestamp": "2019-03-26T17:32:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "940bea5b-7859-430b-b826-e970e18047a", "eventTime": "2019-03-26T17:32:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ADAHTxRBmoFRUC2sv0fFjYbkrITtoMuCpvfQ2AIGmBvmPv+Kub9qMu/8wdPnkHSHCTNTt3AcaePXP1idnTGwlB1fyJvbl4qyficVK02fBODNgA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "940bea5b-7859-430b-b826-e970e18047a", "record_id": "flaws_cloudtrail:0000346:940bea5b-7859-430b-b826-e970e18047a", "row_index": 346, "timestamp": "2019-03-26T17:32:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "940bea5b-7859-430b-b826-e970e18047a", "eventTime": "2019-03-26T17:32:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ADAHTxRBmoFRUC2sv0fFjYbkrITtoMuCpvfQ2AIGmBvmPv+Kub9qMu/8wdPnkHSHCTNTt3AcaePXP1idnTGwlB1fyJvbl4qyficVK02fBODNgA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c9c89bf-c02e-459f-9a27-d51216a75", "record_id": "flaws_cloudtrail:0000347:4c9c89bf-c02e-459f-9a27-d51216a75", "row_index": 347, "timestamp": "2019-03-26T17:32:48Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c9c89bf-c02e-459f-9a27-d51216a75", "eventTime": "2019-03-26T17:32:48Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABLyRA+bpgPwGBfoDDBv11O+cqp4nHGK3wvyOmOSTI3IaLZfU4l7sce+8WXfKwxz/crSAEYP9kMQzhCX3NMmmXTlvxBgOqknBKTyTTAX4cS6Mg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0d04848-1c1d-4814-940a-2b56d9d474b2", "record_id": "flaws_cloudtrail:0000348:e0d04848-1c1d-4814-940a-2b56d9d474b2", "row_index": 348, "timestamp": "2019-03-26T17:32:48Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0d04848-1c1d-4814-940a-2b56d9d474b2", "eventTime": "2019-03-26T17:32:48Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c9c89bf-c02e-459f-9a27-d51216a75", "record_id": "flaws_cloudtrail:0000349:4c9c89bf-c02e-459f-9a27-d51216a75", "row_index": 349, "timestamp": "2019-03-26T17:32:48Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c9c89bf-c02e-459f-9a27-d51216a75", "eventTime": "2019-03-26T17:32:48Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABLyRA+bpgPwGBfoDDBv11O+cqp4nHGK3wvyOmOSTI3IaLZfU4l7sce+8WXfKwxz/crSAEYP9kMQzhCX3NMmmXTlvxBgOqknBKTyTTAX4cS6Mg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0d04848-1c1d-4814-940a-2b56d9d474b2", "record_id": "flaws_cloudtrail:0000350:e0d04848-1c1d-4814-940a-2b56d9d474b2", "row_index": 350, "timestamp": "2019-03-26T17:32:48Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0d04848-1c1d-4814-940a-2b56d9d474b2", "eventTime": "2019-03-26T17:32:48Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77e21988-5a43-4a9a-b3b4-dcbe0d2f0c19", "record_id": "flaws_cloudtrail:0000351:77e21988-5a43-4a9a-b3b4-dcbe0d2f0c19", "row_index": 351, "timestamp": "2019-03-26T17:32:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77e21988-5a43-4a9a-b3b4-dcbe0d2f0c19", "eventTime": "2019-03-26T17:32:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACHmqyITtcFI4YK8VI4hKjv28E0RvudSHVih6YRZh/CuXDJvF5Ub+Ap4HxGzeH6geQr5XifWDE4A+ExsH4wu+w4rg5v8tsi1o/osDRgyxuUBfw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42adde14-b181-44c5-b872-f682f4cb2413", "record_id": "flaws_cloudtrail:0000352:42adde14-b181-44c5-b872-f682f4cb2413", "row_index": 352, "timestamp": "2019-03-26T17:32:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42adde14-b181-44c5-b872-f682f4cb2413", "eventTime": "2019-03-26T17:32:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACpHplL5WocIn8pXVy6ScPrbZspktesWBAQM5BAJr4d0o3lHjUQllx6/fyCPpEQ6pfHtZVhTiB6vRE4ExJgmU4Mvn2UAnhTx4eOTa+TB+iadiw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73d427d4-b542-4063-88ea-d353dbd6a1eb", "record_id": "flaws_cloudtrail:0000353:73d427d4-b542-4063-88ea-d353dbd6a1eb", "row_index": 353, "timestamp": "2019-03-26T17:32:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73d427d4-b542-4063-88ea-d353dbd6a1eb", "eventTime": "2019-03-26T17:32:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABb1sYBfIfyySgTotDmy5rCERbhyzvVUiGpGcbK13PpxfATT+2Hw5e1nlKm55ovktmRakE/JPUH57y8/T4jLDd01TE8xIQtg/OvlW9nLAFxM2A==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77e21988-5a43-4a9a-b3b4-dcbe0d2f0c19", "record_id": "flaws_cloudtrail:0000354:77e21988-5a43-4a9a-b3b4-dcbe0d2f0c19", "row_index": 354, "timestamp": "2019-03-26T17:32:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77e21988-5a43-4a9a-b3b4-dcbe0d2f0c19", "eventTime": "2019-03-26T17:32:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACHmqyITtcFI4YK8VI4hKjv28E0RvudSHVih6YRZh/CuXDJvF5Ub+Ap4HxGzeH6geQr5XifWDE4A+ExsH4wu+w4rg5v8tsi1o/osDRgyxuUBfw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42adde14-b181-44c5-b872-f682f4cb2413", "record_id": "flaws_cloudtrail:0000355:42adde14-b181-44c5-b872-f682f4cb2413", "row_index": 355, "timestamp": "2019-03-26T17:32:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42adde14-b181-44c5-b872-f682f4cb2413", "eventTime": "2019-03-26T17:32:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACpHplL5WocIn8pXVy6ScPrbZspktesWBAQM5BAJr4d0o3lHjUQllx6/fyCPpEQ6pfHtZVhTiB6vRE4ExJgmU4Mvn2UAnhTx4eOTa+TB+iadiw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73d427d4-b542-4063-88ea-d353dbd6a1eb", "record_id": "flaws_cloudtrail:0000356:73d427d4-b542-4063-88ea-d353dbd6a1eb", "row_index": 356, "timestamp": "2019-03-26T17:32:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73d427d4-b542-4063-88ea-d353dbd6a1eb", "eventTime": "2019-03-26T17:32:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABb1sYBfIfyySgTotDmy5rCERbhyzvVUiGpGcbK13PpxfATT+2Hw5e1nlKm55ovktmRakE/JPUH57y8/T4jLDd01TE8xIQtg/OvlW9nLAFxM2A==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "100ab5e6-c12f-489d-8da7-03f3850d7237", "record_id": "flaws_cloudtrail:0000357:100ab5e6-c12f-489d-8da7-03f3850d7237", "row_index": 357, "timestamp": "2019-03-26T17:32:50Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "100ab5e6-c12f-489d-8da7-03f3850d7237", "eventTime": "2019-03-26T17:32:50Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACVp2gr2odGAZsntdopMys9gNvFayCAVRMuZ/9vcYJ8gnlA3CNOh2/2ffM1W8bR3fIIjjjpbrLnNJJf7QC+DI5GowMrb5zcCKc0XmqOvFN0AYw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "100ab5e6-c12f-489d-8da7-03f3850d7237", "record_id": "flaws_cloudtrail:0000358:100ab5e6-c12f-489d-8da7-03f3850d7237", "row_index": 358, "timestamp": "2019-03-26T17:32:50Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "100ab5e6-c12f-489d-8da7-03f3850d7237", "eventTime": "2019-03-26T17:32:50Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACVp2gr2odGAZsntdopMys9gNvFayCAVRMuZ/9vcYJ8gnlA3CNOh2/2ffM1W8bR3fIIjjjpbrLnNJJf7QC+DI5GowMrb5zcCKc0XmqOvFN0AYw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "529889bd1-1298-46b6-b2c2-d6bcf0c005849", "record_id": "flaws_cloudtrail:0000359:529889bd1-1298-46b6-b2c2-d6bcf0c005849", "row_index": 359, "timestamp": "2019-03-26T17:33:33Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "529889bd1-1298-46b6-b2c2-d6bcf0c005849", "eventTime": "2019-03-26T17:33:33Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "529889bd1-1298-46b6-b2c2-d6bcf0c005849", "record_id": "flaws_cloudtrail:0000360:529889bd1-1298-46b6-b2c2-d6bcf0c005849", "row_index": 360, "timestamp": "2019-03-26T17:33:33Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "529889bd1-1298-46b6-b2c2-d6bcf0c005849", "eventTime": "2019-03-26T17:33:33Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4925f91b-b2ae-4728-aa67-6acb29f3f8ee", "record_id": "flaws_cloudtrail:0000361:4925f91b-b2ae-4728-aa67-6acb29f3f8ee", "row_index": 361, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4925f91b-b2ae-4728-aa67-6acb29f3f8ee", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACi+gNv5vAJFKOLE+TkhZjVFvetAVebjFwfJ5NNY+knrteJPoMrycXijzLJ4pJTGqv7ukrx3JzKKg7UrnglOtv1OYUf8wzmD7+YJIxiUQ7ttzA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "caa3dd6b-d3e3-4b26-9682-fd40f5202aae", "record_id": "flaws_cloudtrail:0000362:caa3dd6b-d3e3-4b26-9682-fd40f5202aae", "row_index": 362, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "caa3dd6b-d3e3-4b26-9682-fd40f5202aae", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACR4k5reFUBslHEQdcCimq7mvZ1k+bFbHnXIl/wnrKwLCP6b27X9FIiv+EtW/84wVAg7eVzjln7MDsdxjuBB8GkdaAS1EE0fc26m7qx2VvxUyg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3f63c34-9525-49a1-8890-95a408d4226a", "record_id": "flaws_cloudtrail:0000363:f3f63c34-9525-49a1-8890-95a408d4226a", "row_index": 363, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3f63c34-9525-49a1-8890-95a408d4226a", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABdR2TaBHZGlBzQxWNFopHhYIyyJ6oBOG3lBRKPDVzaigt5OUdZDk25G+pqCZrXm10hh3T843/BP+bBoi0vFCCfmIQAmAEyW0anTnfLCg5gneg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055249f-0114-48bb-8165-6bbfbefc2760", "record_id": "flaws_cloudtrail:0000364:055249f-0114-48bb-8165-6bbfbefc2760", "row_index": 364, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055249f-0114-48bb-8165-6bbfbefc2760", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AB7owse0aR37rh4gmPH3yB5aBm82mJRUyEBbEGKJiYPKhtGS+nScRBclE4HjmyyRaurkcfwXVaR/zK8XRch5UUJAVapbanwv4YSlmgH+le72dw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4925f91b-b2ae-4728-aa67-6acb29f3f8ee", "record_id": "flaws_cloudtrail:0000365:4925f91b-b2ae-4728-aa67-6acb29f3f8ee", "row_index": 365, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4925f91b-b2ae-4728-aa67-6acb29f3f8ee", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACi+gNv5vAJFKOLE+TkhZjVFvetAVebjFwfJ5NNY+knrteJPoMrycXijzLJ4pJTGqv7ukrx3JzKKg7UrnglOtv1OYUf8wzmD7+YJIxiUQ7ttzA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "caa3dd6b-d3e3-4b26-9682-fd40f5202aae", "record_id": "flaws_cloudtrail:0000366:caa3dd6b-d3e3-4b26-9682-fd40f5202aae", "row_index": 366, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "caa3dd6b-d3e3-4b26-9682-fd40f5202aae", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACR4k5reFUBslHEQdcCimq7mvZ1k+bFbHnXIl/wnrKwLCP6b27X9FIiv+EtW/84wVAg7eVzjln7MDsdxjuBB8GkdaAS1EE0fc26m7qx2VvxUyg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3f63c34-9525-49a1-8890-95a408d4226a", "record_id": "flaws_cloudtrail:0000367:f3f63c34-9525-49a1-8890-95a408d4226a", "row_index": 367, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3f63c34-9525-49a1-8890-95a408d4226a", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABdR2TaBHZGlBzQxWNFopHhYIyyJ6oBOG3lBRKPDVzaigt5OUdZDk25G+pqCZrXm10hh3T843/BP+bBoi0vFCCfmIQAmAEyW0anTnfLCg5gneg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055249f-0114-48bb-8165-6bbfbefc2760", "record_id": "flaws_cloudtrail:0000368:055249f-0114-48bb-8165-6bbfbefc2760", "row_index": 368, "timestamp": "2019-03-26T17:33:34Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055249f-0114-48bb-8165-6bbfbefc2760", "eventTime": "2019-03-26T17:33:34Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AB7owse0aR37rh4gmPH3yB5aBm82mJRUyEBbEGKJiYPKhtGS+nScRBclE4HjmyyRaurkcfwXVaR/zK8XRch5UUJAVapbanwv4YSlmgH+le72dw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c1f2c514-81fa-496e-9aa2-8e0f7274c1e8", "record_id": "flaws_cloudtrail:0000369:c1f2c514-81fa-496e-9aa2-8e0f7274c1e8", "row_index": 369, "timestamp": "2019-03-26T17:33:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c1f2c514-81fa-496e-9aa2-8e0f7274c1e8", "eventTime": "2019-03-26T17:33:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACEpXzTtip6wfdX48qGN0jOFVKxcECIuEd6rzoI4C970J8NIffXI7UROavYp3RSxxzEkfkxaE0gvBIDvcxAjipl7Myo+1s9DU/suzaBpRUc6RQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c1f2c514-81fa-496e-9aa2-8e0f7274c1e8", "record_id": "flaws_cloudtrail:0000370:c1f2c514-81fa-496e-9aa2-8e0f7274c1e8", "row_index": 370, "timestamp": "2019-03-26T17:33:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c1f2c514-81fa-496e-9aa2-8e0f7274c1e8", "eventTime": "2019-03-26T17:33:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACEpXzTtip6wfdX48qGN0jOFVKxcECIuEd6rzoI4C970J8NIffXI7UROavYp3RSxxzEkfkxaE0gvBIDvcxAjipl7Myo+1s9DU/suzaBpRUc6RQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff72db1a-1b1d-40cd-b28b-8b6badfd74ca", "record_id": "flaws_cloudtrail:0000371:ff72db1a-1b1d-40cd-b28b-8b6badfd74ca", "row_index": 371, "timestamp": "2019-03-26T17:36:03Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1169, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff72db1a-1b1d-40cd-b28b-8b6badfd74ca", "eventTime": "2019-03-26T17:36:03Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff72db1a-1b1d-40cd-b28b-8b6badfd74ca", "record_id": "flaws_cloudtrail:0000372:ff72db1a-1b1d-40cd-b28b-8b6badfd74ca", "row_index": 372, "timestamp": "2019-03-26T17:36:03Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1169, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff72db1a-1b1d-40cd-b28b-8b6badfd74ca", "eventTime": "2019-03-26T17:36:03Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83f19bed-cb78-45be-a4f3-4399f864e7f4", "record_id": "flaws_cloudtrail:0000373:83f19bed-cb78-45be-a4f3-4399f864e7f4", "row_index": 373, "timestamp": "2019-03-26T17:36:23Z", "event_type": "AttachRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 857, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83f19bed-cb78-45be-a4f3-4399f864e7f4", "eventTime": "2019-03-26T17:36:23Z", "eventName": "AttachRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: iam:AttachRolePolicy on resource: role SecurityAudit", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83f19bed-cb78-45be-a4f3-4399f864e7f4", "record_id": "flaws_cloudtrail:0000374:83f19bed-cb78-45be-a4f3-4399f864e7f4", "row_index": 374, "timestamp": "2019-03-26T17:36:23Z", "event_type": "AttachRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 857, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83f19bed-cb78-45be-a4f3-4399f864e7f4", "eventTime": "2019-03-26T17:36:23Z", "eventName": "AttachRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: iam:AttachRolePolicy on resource: role SecurityAudit", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ba9efdf-0148-48fe-888c-c074db747952", "record_id": "flaws_cloudtrail:0000375:2ba9efdf-0148-48fe-888c-c074db747952", "row_index": 375, "timestamp": "2019-03-26T17:36:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1110, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ba9efdf-0148-48fe-888c-c074db747952", "eventTime": "2019-03-26T17:36:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ba9efdf-0148-48fe-888c-c074db747952", "record_id": "flaws_cloudtrail:0000376:2ba9efdf-0148-48fe-888c-c074db747952", "row_index": 376, "timestamp": "2019-03-26T17:36:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1110, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ba9efdf-0148-48fe-888c-c074db747952", "eventTime": "2019-03-26T17:36:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80caf9cc-f967-446d-85b8-8581fc945091", "record_id": "flaws_cloudtrail:0000377:80caf9cc-f967-446d-85b8-8581fc945091", "row_index": 377, "timestamp": "2019-03-26T17:38:48Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80caf9cc-f967-446d-85b8-8581fc945091", "eventTime": "2019-03-26T17:38:48Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80caf9cc-f967-446d-85b8-8581fc945091", "record_id": "flaws_cloudtrail:0000378:80caf9cc-f967-446d-85b8-8581fc945091", "row_index": 378, "timestamp": "2019-03-26T17:38:48Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80caf9cc-f967-446d-85b8-8581fc945091", "eventTime": "2019-03-26T17:38:48Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9256c694-541b-49e8-9611-f1ddc5ad13d3", "record_id": "flaws_cloudtrail:0000379:9256c694-541b-49e8-9611-f1ddc5ad13d3", "row_index": 379, "timestamp": "2019-03-26T17:39:04Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 678, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9256c694-541b-49e8-9611-f1ddc5ad13d3", "eventTime": "2019-03-26T17:39:04Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9256c694-541b-49e8-9611-f1ddc5ad13d3", "record_id": "flaws_cloudtrail:0000380:9256c694-541b-49e8-9611-f1ddc5ad13d3", "row_index": 380, "timestamp": "2019-03-26T17:39:04Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 678, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9256c694-541b-49e8-9611-f1ddc5ad13d3", "eventTime": "2019-03-26T17:39:04Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e93fbf59-08ad-4d2e-9f2b-204feda846e7", "record_id": "flaws_cloudtrail:0000381:e93fbf59-08ad-4d2e-9f2b-204feda846e7", "row_index": 381, "timestamp": "2019-03-26T17:39:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e93fbf59-08ad-4d2e-9f2b-204feda846e7", "eventTime": "2019-03-26T17:39:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e93fbf59-08ad-4d2e-9f2b-204feda846e7", "record_id": "flaws_cloudtrail:0000382:e93fbf59-08ad-4d2e-9f2b-204feda846e7", "row_index": 382, "timestamp": "2019-03-26T17:39:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e93fbf59-08ad-4d2e-9f2b-204feda846e7", "eventTime": "2019-03-26T17:39:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c577cd4-e735-4573-9d3c-74f1e2ea89e2", "record_id": "flaws_cloudtrail:0000383:6c577cd4-e735-4573-9d3c-74f1e2ea89e2", "row_index": 383, "timestamp": "2019-03-26T17:40:31Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c577cd4-e735-4573-9d3c-74f1e2ea89e2", "eventTime": "2019-03-26T17:40:31Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c577cd4-e735-4573-9d3c-74f1e2ea89e2", "record_id": "flaws_cloudtrail:0000384:6c577cd4-e735-4573-9d3c-74f1e2ea89e2", "row_index": 384, "timestamp": "2019-03-26T17:40:31Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c577cd4-e735-4573-9d3c-74f1e2ea89e2", "eventTime": "2019-03-26T17:40:31Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a7dee48-4744-4a5c-b093-c3f154e9ecdb", "record_id": "flaws_cloudtrail:0000385:4a7dee48-4744-4a5c-b093-c3f154e9ecdb", "row_index": 385, "timestamp": "2019-03-26T17:40:42Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a7dee48-4744-4a5c-b093-c3f154e9ecdb", "eventTime": "2019-03-26T17:40:42Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a7dee48-4744-4a5c-b093-c3f154e9ecdb", "record_id": "flaws_cloudtrail:0000386:4a7dee48-4744-4a5c-b093-c3f154e9ecdb", "row_index": 386, "timestamp": "2019-03-26T17:40:42Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a7dee48-4744-4a5c-b093-c3f154e9ecdb", "eventTime": "2019-03-26T17:40:42Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2be928527-89de-4689-b40d-6ec62339fa05", "record_id": "flaws_cloudtrail:0000387:2be928527-89de-4689-b40d-6ec62339fa05", "row_index": 387, "timestamp": "2019-03-26T17:43:22Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2be928527-89de-4689-b40d-6ec62339fa05", "eventTime": "2019-03-26T17:43:22Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2be928527-89de-4689-b40d-6ec62339fa05", "record_id": "flaws_cloudtrail:0000388:2be928527-89de-4689-b40d-6ec62339fa05", "row_index": 388, "timestamp": "2019-03-26T17:43:22Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2be928527-89de-4689-b40d-6ec62339fa05", "eventTime": "2019-03-26T17:43:22Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04a786046-eecb-4b30-afeb-e8d8003890e4", "record_id": "flaws_cloudtrail:0000389:04a786046-eecb-4b30-afeb-e8d8003890e4", "row_index": 389, "timestamp": "2019-03-26T17:43:39Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04a786046-eecb-4b30-afeb-e8d8003890e4", "eventTime": "2019-03-26T17:43:39Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04a786046-eecb-4b30-afeb-e8d8003890e4", "record_id": "flaws_cloudtrail:0000390:04a786046-eecb-4b30-afeb-e8d8003890e4", "row_index": 390, "timestamp": "2019-03-26T17:43:39Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04a786046-eecb-4b30-afeb-e8d8003890e4", "eventTime": "2019-03-26T17:43:39Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0105c79-0574-4e24-9e9a-9de7706527fa", "record_id": "flaws_cloudtrail:0000391:e0105c79-0574-4e24-9e9a-9de7706527fa", "row_index": 391, "timestamp": "2019-03-26T17:43:47Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0105c79-0574-4e24-9e9a-9de7706527fa", "eventTime": "2019-03-26T17:43:47Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0105c79-0574-4e24-9e9a-9de7706527fa", "record_id": "flaws_cloudtrail:0000392:e0105c79-0574-4e24-9e9a-9de7706527fa", "row_index": 392, "timestamp": "2019-03-26T17:43:47Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0105c79-0574-4e24-9e9a-9de7706527fa", "eventTime": "2019-03-26T17:43:47Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1932c78d-d671-47a2-bdbe-4b9ee6265927", "record_id": "flaws_cloudtrail:0000393:1932c78d-d671-47a2-bdbe-4b9ee6265927", "row_index": 393, "timestamp": "2019-03-26T17:44:53Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 738, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1932c78d-d671-47a2-bdbe-4b9ee6265927", "eventTime": "2019-03-26T17:44:53Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/MySecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1932c78d-d671-47a2-bdbe-4b9ee6265927", "record_id": "flaws_cloudtrail:0000394:1932c78d-d671-47a2-bdbe-4b9ee6265927", "row_index": 394, "timestamp": "2019-03-26T17:44:53Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 738, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1932c78d-d671-47a2-bdbe-4b9ee6265927", "eventTime": "2019-03-26T17:44:53Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/MySecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee8804c0-871a-48ec-a738-3b0ab674df90", "record_id": "flaws_cloudtrail:0000395:ee8804c0-871a-48ec-a738-3b0ab674df90", "row_index": 395, "timestamp": "2019-03-26T17:45:18Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee8804c0-871a-48ec-a738-3b0ab674df90", "eventTime": "2019-03-26T17:45:18Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee8804c0-871a-48ec-a738-3b0ab674df90", "record_id": "flaws_cloudtrail:0000396:ee8804c0-871a-48ec-a738-3b0ab674df90", "row_index": 396, "timestamp": "2019-03-26T17:45:18Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee8804c0-871a-48ec-a738-3b0ab674df90", "eventTime": "2019-03-26T17:45:18Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ab7a242-66ca-425d-8d41-f80e834abfc2", "record_id": "flaws_cloudtrail:0000397:7ab7a242-66ca-425d-8d41-f80e834abfc2", "row_index": 397, "timestamp": "2019-03-26T17:48:57Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ab7a242-66ca-425d-8d41-f80e834abfc2", "eventTime": "2019-03-26T17:48:57Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ab7a242-66ca-425d-8d41-f80e834abfc2", "record_id": "flaws_cloudtrail:0000398:7ab7a242-66ca-425d-8d41-f80e834abfc2", "row_index": 398, "timestamp": "2019-03-26T17:48:57Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ab7a242-66ca-425d-8d41-f80e834abfc2", "eventTime": "2019-03-26T17:48:57Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fb74bff-1e56-4169-ac02-1314d1d70e0f", "record_id": "flaws_cloudtrail:0000399:3fb74bff-1e56-4169-ac02-1314d1d70e0f", "row_index": 399, "timestamp": "2019-03-26T17:54:11Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fb74bff-1e56-4169-ac02-1314d1d70e0f", "eventTime": "2019-03-26T17:54:11Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fb74bff-1e56-4169-ac02-1314d1d70e0f", "record_id": "flaws_cloudtrail:0000400:3fb74bff-1e56-4169-ac02-1314d1d70e0f", "row_index": 400, "timestamp": "2019-03-26T17:54:11Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fb74bff-1e56-4169-ac02-1314d1d70e0f", "eventTime": "2019-03-26T17:54:11Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1edf3e7d-3114-4fd9-b1c8-3cc14fe6aca1", "record_id": "flaws_cloudtrail:0000401:1edf3e7d-3114-4fd9-b1c8-3cc14fe6aca1", "row_index": 401, "timestamp": "2019-03-26T17:54:28Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1edf3e7d-3114-4fd9-b1c8-3cc14fe6aca1", "eventTime": "2019-03-26T17:54:28Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1edf3e7d-3114-4fd9-b1c8-3cc14fe6aca1", "record_id": "flaws_cloudtrail:0000402:1edf3e7d-3114-4fd9-b1c8-3cc14fe6aca1", "row_index": 402, "timestamp": "2019-03-26T17:54:28Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1edf3e7d-3114-4fd9-b1c8-3cc14fe6aca1", "eventTime": "2019-03-26T17:54:28Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a173e743-7893-4f0c-bef7-6a7868cc6901", "record_id": "flaws_cloudtrail:0000403:a173e743-7893-4f0c-bef7-6a7868cc6901", "row_index": 403, "timestamp": "2019-03-26T17:56:21Z", "event_type": "ListPolicyVersions", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a173e743-7893-4f0c-bef7-6a7868cc6901", "eventTime": "2019-03-26T17:56:21Z", "eventName": "ListPolicyVersions", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a173e743-7893-4f0c-bef7-6a7868cc6901", "record_id": "flaws_cloudtrail:0000404:a173e743-7893-4f0c-bef7-6a7868cc6901", "row_index": 404, "timestamp": "2019-03-26T17:56:21Z", "event_type": "ListPolicyVersions", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a173e743-7893-4f0c-bef7-6a7868cc6901", "eventTime": "2019-03-26T17:56:21Z", "eventName": "ListPolicyVersions", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1f512fc-5f23-47c5-af19-94a4db6d536a", "record_id": "flaws_cloudtrail:0000405:d1f512fc-5f23-47c5-af19-94a4db6d536a", "row_index": 405, "timestamp": "2019-03-26T17:56:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1f512fc-5f23-47c5-af19-94a4db6d536a", "eventTime": "2019-03-26T17:56:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1f512fc-5f23-47c5-af19-94a4db6d536a", "record_id": "flaws_cloudtrail:0000406:d1f512fc-5f23-47c5-af19-94a4db6d536a", "row_index": 406, "timestamp": "2019-03-26T17:56:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1f512fc-5f23-47c5-af19-94a4db6d536a", "eventTime": "2019-03-26T17:56:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf320d14-815f-466f-8383-8d81f48dffb8", "record_id": "flaws_cloudtrail:0000407:bf320d14-815f-466f-8383-8d81f48dffb8", "row_index": 407, "timestamp": "2019-03-26T17:56:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf320d14-815f-466f-8383-8d81f48dffb8", "eventTime": "2019-03-26T17:56:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwQ0VDdFFqa3FhOURCbEhuN2tjQ1VKRFNGV29qZ2JpYnNTaFE2Mk1VNFpEUXgrZzgvN2l6MDNSS2s3OFRZVlFKRGxtcUxDSE5JNlFVUkF3MGRiWW5UeUdCWlNkbEM2a1VpQWN1U2xaOEFPYzZDV3ZIQUhDNjlhREhOdGtrVHd5NnYwQW1NZzMzaU8rVkNidFBIL0I3b1greUNlMzFFRlRzS3JQVEFSS1NpSitzRlRHQ1FQejlpNDlpSGRFNVk4WUVCNkY0dFFEbU5jWk1Odz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf320d14-815f-466f-8383-8d81f48dffb8", "record_id": "flaws_cloudtrail:0000408:bf320d14-815f-466f-8383-8d81f48dffb8", "row_index": 408, "timestamp": "2019-03-26T17:56:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf320d14-815f-466f-8383-8d81f48dffb8", "eventTime": "2019-03-26T17:56:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwQ0VDdFFqa3FhOURCbEhuN2tjQ1VKRFNGV29qZ2JpYnNTaFE2Mk1VNFpEUXgrZzgvN2l6MDNSS2s3OFRZVlFKRGxtcUxDSE5JNlFVUkF3MGRiWW5UeUdCWlNkbEM2a1VpQWN1U2xaOEFPYzZDV3ZIQUhDNjlhREhOdGtrVHd5NnYwQW1NZzMzaU8rVkNidFBIL0I3b1greUNlMzFFRlRzS3JQVEFSS1NpSitzRlRHQ1FQejlpNDlpSGRFNVk4WUVCNkY0dFFEbU5jWk1Odz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b85ebf95-79c9-456d-a552-ac4edc53d187", "record_id": "flaws_cloudtrail:0000409:b85ebf95-79c9-456d-a552-ac4edc53d187", "row_index": 409, "timestamp": "2019-03-26T17:56:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b85ebf95-79c9-456d-a552-ac4edc53d187", "eventTime": "2019-03-26T17:56:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5blVDbU9Wakl6L3E3eHd3dGNOTDBOWXJHTGtVdGZGNzVueGVFU2hGS0NuSTZSV0VUN0pFWlE1d0syMFU5a0hvNlpEM3BRbDU5ZE9XYVFwajQ3UGZLUlliTURZLzA3WTZkZVhoS2hLR3hxejRyeFlNc3htM1dtbFF6czJ3NG1UcjZIK0RRSkc2S2V4TTRRSUN1OUVvSWttdHZET0l0MGlXS1lXaFBocnp2MXp6dlA2cnRHTzJjQmxYTEpTRUZjN3JScGJxQWxJQm05bWRRQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b85ebf95-79c9-456d-a552-ac4edc53d187", "record_id": "flaws_cloudtrail:0000410:b85ebf95-79c9-456d-a552-ac4edc53d187", "row_index": 410, "timestamp": "2019-03-26T17:56:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b85ebf95-79c9-456d-a552-ac4edc53d187", "eventTime": "2019-03-26T17:56:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5blVDbU9Wakl6L3E3eHd3dGNOTDBOWXJHTGtVdGZGNzVueGVFU2hGS0NuSTZSV0VUN0pFWlE1d0syMFU5a0hvNlpEM3BRbDU5ZE9XYVFwajQ3UGZLUlliTURZLzA3WTZkZVhoS2hLR3hxejRyeFlNc3htM1dtbFF6czJ3NG1UcjZIK0RRSkc2S2V4TTRRSUN1OUVvSWttdHZET0l0MGlXS1lXaFBocnp2MXp6dlA2cnRHTzJjQmxYTEpTRUZjN3JScGJxQWxJQm05bWRRQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c71bd65-afbb-4f39-8292-cd52d8d1bb37", "record_id": "flaws_cloudtrail:0000411:4c71bd65-afbb-4f39-8292-cd52d8d1bb37", "row_index": 411, "timestamp": "2019-03-26T17:56:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c71bd65-afbb-4f39-8292-cd52d8d1bb37", "eventTime": "2019-03-26T17:56:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkK21teFQyTmJVUmNnOHdxbjdjK3ZRejFUcktQckdQWG10TWgrVDBNSE4vVkU0N1paRjBOSkVOMkJlZzZJajI1WCtSa0cwYmh6ZW5GSWhnZGRUSXhETXFMM1VHVjkvTFlQaFZsV3RNd3dua2dBYUdJQTI1bzlaRm9TRmQ2dGQrL1A0M1E4V2Z5dVdYRmZLSzdzOTdndS9ob0hHd1IxNVU4QUt1Q0IyMWdhNElVL2JEYVR5a2tjYiszZTZkOEFYdEQvUHJxWktSTURBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c71bd65-afbb-4f39-8292-cd52d8d1bb37", "record_id": "flaws_cloudtrail:0000412:4c71bd65-afbb-4f39-8292-cd52d8d1bb37", "row_index": 412, "timestamp": "2019-03-26T17:56:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c71bd65-afbb-4f39-8292-cd52d8d1bb37", "eventTime": "2019-03-26T17:56:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkK21teFQyTmJVUmNnOHdxbjdjK3ZRejFUcktQckdQWG10TWgrVDBNSE4vVkU0N1paRjBOSkVOMkJlZzZJajI1WCtSa0cwYmh6ZW5GSWhnZGRUSXhETXFMM1VHVjkvTFlQaFZsV3RNd3dua2dBYUdJQTI1bzlaRm9TRmQ2dGQrL1A0M1E4V2Z5dVdYRmZLSzdzOTdndS9ob0hHd1IxNVU4QUt1Q0IyMWdhNElVL2JEYVR5a2tjYiszZTZkOEFYdEQvUHJxWktSTURBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5eb962d2-1d67-4c38-b18f-2e588d1b3fd8", "record_id": "flaws_cloudtrail:0000413:5eb962d2-1d67-4c38-b18f-2e588d1b3fd8", "row_index": 413, "timestamp": "2019-03-26T17:56:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5eb962d2-1d67-4c38-b18f-2e588d1b3fd8", "eventTime": "2019-03-26T17:56:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOSFM0WEtJZEtiVFlROXhUUVRxalkxQTd0Ukh5M2tzaW1HaGxkdk5WdTR5VTh5bXBGYkJCRTVLVEIrMlNoczUxUGZ2T1JEaDBtYTNjc1I1UDlGVzkvTnZhSmVteEIxMXlsUVpBelZkakNQbis2TnhKeWRTU1lpZnJFZUM0TmZmZXNDUU1RaWZOYStWUGxUTzBzL0NvaWZxZTdycjFISEVybjNOTzUvaUFBcDBPWFZCQkxaN2lGY09qemxXTXRNMGdSWmhjQi84U0tCWC9EQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5eb962d2-1d67-4c38-b18f-2e588d1b3fd8", "record_id": "flaws_cloudtrail:0000414:5eb962d2-1d67-4c38-b18f-2e588d1b3fd8", "row_index": 414, "timestamp": "2019-03-26T17:56:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5eb962d2-1d67-4c38-b18f-2e588d1b3fd8", "eventTime": "2019-03-26T17:56:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOSFM0WEtJZEtiVFlROXhUUVRxalkxQTd0Ukh5M2tzaW1HaGxkdk5WdTR5VTh5bXBGYkJCRTVLVEIrMlNoczUxUGZ2T1JEaDBtYTNjc1I1UDlGVzkvTnZhSmVteEIxMXlsUVpBelZkakNQbis2TnhKeWRTU1lpZnJFZUM0TmZmZXNDUU1RaWZOYStWUGxUTzBzL0NvaWZxZTdycjFISEVybjNOTzUvaUFBcDBPWFZCQkxaN2lGY09qemxXTXRNMGdSWmhjQi84U0tCWC9EQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a42e21bf-f8ab-4f7f-bd25-20932a50d", "record_id": "flaws_cloudtrail:0000415:a42e21bf-f8ab-4f7f-bd25-20932a50d", "row_index": 415, "timestamp": "2019-03-26T17:57:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a42e21bf-f8ab-4f7f-bd25-20932a50d", "eventTime": "2019-03-26T17:57:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIT1ErQmFFV1BnelJFRHQ3M3c4cmFlK0Y1dnVHZkIzOCtqcURTQW5nVUVLM2hmU01GYUUyajNrZVZIRWNTQmFuQS8rUVdMRTRzYUJWdkl3Ykl1UGdNaTRIQktkeXp1aTcxQmo1L0JSdkNyRktvM3JwOXowamJybnA2NEF3ZERBcmUrRUFSa2tUTE9WRnNWL3ZiUmEwUGdXYTVySUVLcGRGcytMcW5maENVQjhTQ1hHdE9TcTBYdDd2eXA5MHpSYmlaVW8valp0WWxaNURIZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a42e21bf-f8ab-4f7f-bd25-20932a50d", "record_id": "flaws_cloudtrail:0000416:a42e21bf-f8ab-4f7f-bd25-20932a50d", "row_index": 416, "timestamp": "2019-03-26T17:57:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a42e21bf-f8ab-4f7f-bd25-20932a50d", "eventTime": "2019-03-26T17:57:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIT1ErQmFFV1BnelJFRHQ3M3c4cmFlK0Y1dnVHZkIzOCtqcURTQW5nVUVLM2hmU01GYUUyajNrZVZIRWNTQmFuQS8rUVdMRTRzYUJWdkl3Ykl1UGdNaTRIQktkeXp1aTcxQmo1L0JSdkNyRktvM3JwOXowamJybnA2NEF3ZERBcmUrRUFSa2tUTE9WRnNWL3ZiUmEwUGdXYTVySUVLcGRGcytMcW5maENVQjhTQ1hHdE9TcTBYdDd2eXA5MHpSYmlaVW8valp0WWxaNURIZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa0a5ab6-9df2-40c0-b50d-cac0dd06b08c", "record_id": "flaws_cloudtrail:0000417:aa0a5ab6-9df2-40c0-b50d-cac0dd06b08c", "row_index": 417, "timestamp": "2019-03-26T17:57:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa0a5ab6-9df2-40c0-b50d-cac0dd06b08c", "eventTime": "2019-03-26T17:57:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmWTVDTCtWSmFPN1VydDBZcnVDMHRVK1BxaWpSODNMa25UVXVRdXBpczZocHRlVFN3NnIrdWRnVVQ1ZFB5OEk0YjBsNjU0S3NqZU1OUnlXaXg0T2VsUW10b2FtZlJSMDJ2TEwzV0JHdjBDdTdrakhDenFEa2h6RzZUTGNjdHE4RmdSVWFJdnlzRDc2aThJWmcxZ01jemcwbnRrZWlENzJMNzl6RjB6dkZDdDRnWGVHdGhDUTczZTBUYTVUcm5rTFY1d1pxUDNXZzJwRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa0a5ab6-9df2-40c0-b50d-cac0dd06b08c", "record_id": "flaws_cloudtrail:0000418:aa0a5ab6-9df2-40c0-b50d-cac0dd06b08c", "row_index": 418, "timestamp": "2019-03-26T17:57:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa0a5ab6-9df2-40c0-b50d-cac0dd06b08c", "eventTime": "2019-03-26T17:57:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmWTVDTCtWSmFPN1VydDBZcnVDMHRVK1BxaWpSODNMa25UVXVRdXBpczZocHRlVFN3NnIrdWRnVVQ1ZFB5OEk0YjBsNjU0S3NqZU1OUnlXaXg0T2VsUW10b2FtZlJSMDJ2TEwzV0JHdjBDdTdrakhDenFEa2h6RzZUTGNjdHE4RmdSVWFJdnlzRDc2aThJWmcxZ01jemcwbnRrZWlENzJMNzl6RjB6dkZDdDRnWGVHdGhDUTczZTBUYTVUcm5rTFY1d1pxUDNXZzJwRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e248bf3b-cde2-4987-b792-e4868f754556", "record_id": "flaws_cloudtrail:0000419:e248bf3b-cde2-4987-b792-e4868f754556", "row_index": 419, "timestamp": "2019-03-26T17:57:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e248bf3b-cde2-4987-b792-e4868f754556", "eventTime": "2019-03-26T17:57:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2ckRCWUtZWkljTlovY255YXQ4SmdqSVp4dThKV25YT09MNURsL21uSllPUmEycFJwdnFOQ3ZsYmpLck52NU5obTJNNG56TTU5M1E5dkIvV1B0VlpVZE5HbmdOa25nNEE4ekhMcSs4RVc0QVdINjFlSUFQajBnbXhCQ2JuUXE1ZFpNeGt0ejUyQUwzNHFYQWhoSEs3UHdpZzdBSkhnUU1NYWdaWGdKNWplemJ6d1VVSnNUNjdGZGZycXNVZGxJd2Rjb0NUV0lUbjZCNS9nUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e248bf3b-cde2-4987-b792-e4868f754556", "record_id": "flaws_cloudtrail:0000420:e248bf3b-cde2-4987-b792-e4868f754556", "row_index": 420, "timestamp": "2019-03-26T17:57:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e248bf3b-cde2-4987-b792-e4868f754556", "eventTime": "2019-03-26T17:57:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2ckRCWUtZWkljTlovY255YXQ4SmdqSVp4dThKV25YT09MNURsL21uSllPUmEycFJwdnFOQ3ZsYmpLck52NU5obTJNNG56TTU5M1E5dkIvV1B0VlpVZE5HbmdOa25nNEE4ekhMcSs4RVc0QVdINjFlSUFQajBnbXhCQ2JuUXE1ZFpNeGt0ejUyQUwzNHFYQWhoSEs3UHdpZzdBSkhnUU1NYWdaWGdKNWplemJ6d1VVSnNUNjdGZGZycXNVZGxJd2Rjb0NUV0lUbjZCNS9nUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66422-c0ba-4da9-8e46-89587b6cd47", "record_id": "flaws_cloudtrail:0000421:66422-c0ba-4da9-8e46-89587b6cd47", "row_index": 421, "timestamp": "2019-03-26T17:57:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66422-c0ba-4da9-8e46-89587b6cd47", "eventTime": "2019-03-26T17:57:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOZGNSUHFrYkp0T1laN2tTTmF2RjAxYTVMb1dYMVBMdkwwWUg2QnhTdUdKSEF0ejJUb2R6UFA1d0lKc3FrYmpCY0JtSTFlWEtTWVNNd1cvb2p6eVU1b0h5VUtYVSs5YmQreFhyWDBDYVN6KzFHQWdUQlcwN2h3eE5TelFKcGZOOVRueUFkTWdxbTV2MlZXeXI0RjUxcGR2U08rZXRESEdETUVFRDFxNzhITC9ta1g4MG0ycHpnZ05XbTQ5MFpSaDRnd1JKdGpoeCtxZVlmdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66422-c0ba-4da9-8e46-89587b6cd47", "record_id": "flaws_cloudtrail:0000422:66422-c0ba-4da9-8e46-89587b6cd47", "row_index": 422, "timestamp": "2019-03-26T17:57:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66422-c0ba-4da9-8e46-89587b6cd47", "eventTime": "2019-03-26T17:57:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOZGNSUHFrYkp0T1laN2tTTmF2RjAxYTVMb1dYMVBMdkwwWUg2QnhTdUdKSEF0ejJUb2R6UFA1d0lKc3FrYmpCY0JtSTFlWEtTWVNNd1cvb2p6eVU1b0h5VUtYVSs5YmQreFhyWDBDYVN6KzFHQWdUQlcwN2h3eE5TelFKcGZOOVRueUFkTWdxbTV2MlZXeXI0RjUxcGR2U08rZXRESEdETUVFRDFxNzhITC9ta1g4MG0ycHpnZ05XbTQ5MFpSaDRnd1JKdGpoeCtxZVlmdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b357801dd-1693-4a7d-92d1-3a279ef5edb4", "record_id": "flaws_cloudtrail:0000423:b357801dd-1693-4a7d-92d1-3a279ef5edb4", "row_index": 423, "timestamp": "2019-03-26T17:57:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b357801dd-1693-4a7d-92d1-3a279ef5edb4", "eventTime": "2019-03-26T17:57:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJVWVUOHdUL0M5Q1Nyb25XMnJrZm1QYXNTWkdtR1B3MGQrUG1uTHVjNWlNYk5xUHhuUFJBYjEwOUdGam1na3g0cU1sUVU5WHgybCtxbmM0Y3ZOanRHcnBCSmF0cldCeFhXenRZand6TGNNWGNjZmlBVURTbUNIaUdVd2hPQkNlTEVsbE5ybXdYajlkb3Z2NUUzSGZiNUZrL0dOZ0RBN2NURjFvZlE1VXI2N0VJQXlzY1VBWituck5LTUxPN0loYm1OempUY0hrd291eVBHdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b357801dd-1693-4a7d-92d1-3a279ef5edb4", "record_id": "flaws_cloudtrail:0000424:b357801dd-1693-4a7d-92d1-3a279ef5edb4", "row_index": 424, "timestamp": "2019-03-26T17:57:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b357801dd-1693-4a7d-92d1-3a279ef5edb4", "eventTime": "2019-03-26T17:57:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJVWVUOHdUL0M5Q1Nyb25XMnJrZm1QYXNTWkdtR1B3MGQrUG1uTHVjNWlNYk5xUHhuUFJBYjEwOUdGam1na3g0cU1sUVU5WHgybCtxbmM0Y3ZOanRHcnBCSmF0cldCeFhXenRZand6TGNNWGNjZmlBVURTbUNIaUdVd2hPQkNlTEVsbE5ybXdYajlkb3Z2NUUzSGZiNUZrL0dOZ0RBN2NURjFvZlE1VXI2N0VJQXlzY1VBWituck5LTUxPN0loYm1OempUY0hrd291eVBHdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6877f0f-55a8-4488-96c9-7b68637b45f0", "record_id": "flaws_cloudtrail:0000425:c6877f0f-55a8-4488-96c9-7b68637b45f0", "row_index": 425, "timestamp": "2019-03-26T17:57:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6877f0f-55a8-4488-96c9-7b68637b45f0", "eventTime": "2019-03-26T17:57:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlMGg5WExqRUJ2SzQ2MzI2elVEeFlpVUNRYWl3SytIWFA4NDlyL0hsTFlnTERUamRkK055dWxOd1ZURU1RQy9CczZkaVhsZURBMHJSb2M0aTFEL3dSTGJEdXJTWGZYd0VDR0oyNUIwVUxqQmYvb1RGMEhXVnRESWswWXNwZlI5TW0xTTY1UDBVOTh1N2xOcHI5V1VHYjBtRFVobS9ldi9ZTFlua2pVY1lmbGYzOVZuL1gvU0laUjdtNU94Njk3V0JQNXVzcEQxMEFhb0hIZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6877f0f-55a8-4488-96c9-7b68637b45f0", "record_id": "flaws_cloudtrail:0000426:c6877f0f-55a8-4488-96c9-7b68637b45f0", "row_index": 426, "timestamp": "2019-03-26T17:57:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6877f0f-55a8-4488-96c9-7b68637b45f0", "eventTime": "2019-03-26T17:57:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlMGg5WExqRUJ2SzQ2MzI2elVEeFlpVUNRYWl3SytIWFA4NDlyL0hsTFlnTERUamRkK055dWxOd1ZURU1RQy9CczZkaVhsZURBMHJSb2M0aTFEL3dSTGJEdXJTWGZYd0VDR0oyNUIwVUxqQmYvb1RGMEhXVnRESWswWXNwZlI5TW0xTTY1UDBVOTh1N2xOcHI5V1VHYjBtRFVobS9ldi9ZTFlua2pVY1lmbGYzOVZuL1gvU0laUjdtNU94Njk3V0JQNXVzcEQxMEFhb0hIZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26b7a9fa-3a1a-4a74-b0a7-4fc763abfeb1", "record_id": "flaws_cloudtrail:0000427:26b7a9fa-3a1a-4a74-b0a7-4fc763abfeb1", "row_index": 427, "timestamp": "2019-03-26T17:57:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26b7a9fa-3a1a-4a74-b0a7-4fc763abfeb1", "eventTime": "2019-03-26T17:57:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJUlNEUGFWeE9uclZvdklXVWNnR2wrcjlic3c0UlhsRUFsM05pRzJjTDlxaEM1eGQwMnNsKzdySmZFeGVXREtjT0VsVFloMTlReVhvMjFYZ2c0VXRySlpScGcra05JeXlvVlBPbXpNT0Q5bk1VeVIzSW1qaDVOZkRJamYva1dBWDQraWFDTjVFaFEwVzhEMU9MS09vbmtlRFFYRXNja1JNOXdLZE11eWNsUmU1RjErNHVEN2lHQXBCaGhoY0M4Q29ReHBSOW96MWxOSXRmdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26b7a9fa-3a1a-4a74-b0a7-4fc763abfeb1", "record_id": "flaws_cloudtrail:0000428:26b7a9fa-3a1a-4a74-b0a7-4fc763abfeb1", "row_index": 428, "timestamp": "2019-03-26T17:57:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26b7a9fa-3a1a-4a74-b0a7-4fc763abfeb1", "eventTime": "2019-03-26T17:57:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJUlNEUGFWeE9uclZvdklXVWNnR2wrcjlic3c0UlhsRUFsM05pRzJjTDlxaEM1eGQwMnNsKzdySmZFeGVXREtjT0VsVFloMTlReVhvMjFYZ2c0VXRySlpScGcra05JeXlvVlBPbXpNT0Q5bk1VeVIzSW1qaDVOZkRJamYva1dBWDQraWFDTjVFaFEwVzhEMU9MS09vbmtlRFFYRXNja1JNOXdLZE11eWNsUmU1RjErNHVEN2lHQXBCaGhoY0M4Q29ReHBSOW96MWxOSXRmdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e38bfaae-a802-4c6e-9ffc-4ecb8e8ebb37", "record_id": "flaws_cloudtrail:0000429:e38bfaae-a802-4c6e-9ffc-4ecb8e8ebb37", "row_index": 429, "timestamp": "2019-03-26T17:57:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e38bfaae-a802-4c6e-9ffc-4ecb8e8ebb37", "eventTime": "2019-03-26T17:57:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwT0FOZUYwT281Q0JRWmtvbVFrWUZqclRlUXMwZTdnSWt1TkhpcGg0QlNkZHN0M1hGdm5nTUhRSlNHOCs3bk9vVDlRVzk3N3phZEErcUtPTXJCTXVieDVnRkJnZUNudWJxZ1FzMVEreXBKbUswbDkxMTVhRWxDSjUwV1REc2s1ODhGS3I1NFZFK3ZNd21NaEEwMm4wOUhWTmNNUEZCbTREMEptRmhEMW5lK01kczVWa015OFNCMUJJRGkzL3Y1OHV6Y3drQVFJOG5CK1lxdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e38bfaae-a802-4c6e-9ffc-4ecb8e8ebb37", "record_id": "flaws_cloudtrail:0000430:e38bfaae-a802-4c6e-9ffc-4ecb8e8ebb37", "row_index": 430, "timestamp": "2019-03-26T17:57:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e38bfaae-a802-4c6e-9ffc-4ecb8e8ebb37", "eventTime": "2019-03-26T17:57:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwT0FOZUYwT281Q0JRWmtvbVFrWUZqclRlUXMwZTdnSWt1TkhpcGg0QlNkZHN0M1hGdm5nTUhRSlNHOCs3bk9vVDlRVzk3N3phZEErcUtPTXJCTXVieDVnRkJnZUNudWJxZ1FzMVEreXBKbUswbDkxMTVhRWxDSjUwV1REc2s1ODhGS3I1NFZFK3ZNd21NaEEwMm4wOUhWTmNNUEZCbTREMEptRmhEMW5lK01kczVWa015OFNCMUJJRGkzL3Y1OHV6Y3drQVFJOG5CK1lxdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "adbbf955-c141-4b01-a481-3bfd77bfb4e1", "record_id": "flaws_cloudtrail:0000431:adbbf955-c141-4b01-a481-3bfd77bfb4e1", "row_index": 431, "timestamp": "2019-03-26T17:57:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "adbbf955-c141-4b01-a481-3bfd77bfb4e1", "eventTime": "2019-03-26T17:57:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWNGFLRTJUZkpKanZBQStiNjRxUm8wbmh6VFVlWWNNMzg3YWdhd1gvNU5jUFdzNmtxbmhXTXlKTjhLSXdOWXhDRk52L3RJWXlOekpNR1dwNENKNXM4SGVpemJ5TnQyL1lPVjJ6dXR6bEFDbjVwdjJvRm14SjNwcExRUDl4b0V0dDdaVGM5c2NtakQvZXB1VTBmMVdSemhKWHhMZkQxb2k2NDBNSUNWaXN2YmJGRHdTTHpCa3VWYiswZG84V2JiM2pMNFJGSmRMMExWaU9GUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "adbbf955-c141-4b01-a481-3bfd77bfb4e1", "record_id": "flaws_cloudtrail:0000432:adbbf955-c141-4b01-a481-3bfd77bfb4e1", "row_index": 432, "timestamp": "2019-03-26T17:57:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "adbbf955-c141-4b01-a481-3bfd77bfb4e1", "eventTime": "2019-03-26T17:57:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWNGFLRTJUZkpKanZBQStiNjRxUm8wbmh6VFVlWWNNMzg3YWdhd1gvNU5jUFdzNmtxbmhXTXlKTjhLSXdOWXhDRk52L3RJWXlOekpNR1dwNENKNXM4SGVpemJ5TnQyL1lPVjJ6dXR6bEFDbjVwdjJvRm14SjNwcExRUDl4b0V0dDdaVGM5c2NtakQvZXB1VTBmMVdSemhKWHhMZkQxb2k2NDBNSUNWaXN2YmJGRHdTTHpCa3VWYiswZG84V2JiM2pMNFJGSmRMMExWaU9GUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b819371d-4358-459b-bbf1-9d0f19a9f4bc", "record_id": "flaws_cloudtrail:0000433:b819371d-4358-459b-bbf1-9d0f19a9f4bc", "row_index": 433, "timestamp": "2019-03-26T17:57:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b819371d-4358-459b-bbf1-9d0f19a9f4bc", "eventTime": "2019-03-26T17:57:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4UEpPek9wbEU3akoxMzc1TitPQmVUL0l5dDlzL1hsWCt1eXJncmpJSzRWN3hLckRDcnFjR3pyRjNTTmZ4VEV4U3dkSVZESy8xTTJPQjNzNWs3OC81SkljSmF1V29ZczlRbzdtOXAyK3o3OGZuelZETVF1TVcwYzByOHFKcFlJdyttODNBYVdmWVpBUWVDZW9BTE5DNjR3NXBhN3B5ZTJtelA5OERISXpNL21rcmNGekkrQTRNOHp5elhDOTNVanZKZVhTUTB0bVphbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b819371d-4358-459b-bbf1-9d0f19a9f4bc", "record_id": "flaws_cloudtrail:0000434:b819371d-4358-459b-bbf1-9d0f19a9f4bc", "row_index": 434, "timestamp": "2019-03-26T17:57:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b819371d-4358-459b-bbf1-9d0f19a9f4bc", "eventTime": "2019-03-26T17:57:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4UEpPek9wbEU3akoxMzc1TitPQmVUL0l5dDlzL1hsWCt1eXJncmpJSzRWN3hLckRDcnFjR3pyRjNTTmZ4VEV4U3dkSVZESy8xTTJPQjNzNWs3OC81SkljSmF1V29ZczlRbzdtOXAyK3o3OGZuelZETVF1TVcwYzByOHFKcFlJdyttODNBYVdmWVpBUWVDZW9BTE5DNjR3NXBhN3B5ZTJtelA5OERISXpNL21rcmNGekkrQTRNOHp5elhDOTNVanZKZVhTUTB0bVphbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59d57e67-c3c4-47ad-91ac-269cb4a4792a", "record_id": "flaws_cloudtrail:0000435:59d57e67-c3c4-47ad-91ac-269cb4a4792a", "row_index": 435, "timestamp": "2019-03-26T17:57:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59d57e67-c3c4-47ad-91ac-269cb4a4792a", "eventTime": "2019-03-26T17:57:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhMEJxekN1YUlIV24ySkhhcVRNYVRCZVpTSEZteDZLMXNkVlEvdy96VUNVMGd2REw0ejlPOStKSXlHTjVEYjBMTkxWa2tORTBiRkRnZHRBUE40cjJZeU9xdXpScEs5MkhkMDBCN005djJILy9XdmtYemE3UW16RmRrYWV1TDdZazN1Q084RTNHQm1FVmNxbnprdWQrK25BdFNJbUtZdkU2MHA2RlhzRjA4dGxuTE1meGhtdU5Ib0hHTXIwTEVMU21TQlpGL3lwWTVJeHBtRUh1WXZYSXZBaWZPZUxwSzBjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59d57e67-c3c4-47ad-91ac-269cb4a4792a", "record_id": "flaws_cloudtrail:0000436:59d57e67-c3c4-47ad-91ac-269cb4a4792a", "row_index": 436, "timestamp": "2019-03-26T17:57:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59d57e67-c3c4-47ad-91ac-269cb4a4792a", "eventTime": "2019-03-26T17:57:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhMEJxekN1YUlIV24ySkhhcVRNYVRCZVpTSEZteDZLMXNkVlEvdy96VUNVMGd2REw0ejlPOStKSXlHTjVEYjBMTkxWa2tORTBiRkRnZHRBUE40cjJZeU9xdXpScEs5MkhkMDBCN005djJILy9XdmtYemE3UW16RmRrYWV1TDdZazN1Q084RTNHQm1FVmNxbnprdWQrK25BdFNJbUtZdkU2MHA2RlhzRjA4dGxuTE1meGhtdU5Ib0hHTXIwTEVMU21TQlpGL3lwWTVJeHBtRUh1WXZYSXZBaWZPZUxwSzBjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c378830a-8018-413d-961b-0108519c8efd", "record_id": "flaws_cloudtrail:0000437:1c378830a-8018-413d-961b-0108519c8efd", "row_index": 437, "timestamp": "2019-03-26T17:57:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c378830a-8018-413d-961b-0108519c8efd", "eventTime": "2019-03-26T17:57:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIyYVhQMGgreWkyVFd4MS9uUmdoMHZtZGtpRnhTeEc4OGcvSjFHL1BKUEw0T3ZmZUFEbnVjQncvMGh1dllOT3NEejBFQzZjM085UTVYTUpETm1ieWxnN3ZBWHpsbDl5SWVOd1JONTJkWGJHNDNHV3Nzd0NUMTg2UW45cW92Zkd3SnQ2eXV0SXdUVHJVQ2Rjc0hsQmhhS1p2RGYxUTBWTlNzUDJNbmJDOEJsVHAzUWFacUlLL05LWTEzZHVpMHdrMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c378830a-8018-413d-961b-0108519c8efd", "record_id": "flaws_cloudtrail:0000438:1c378830a-8018-413d-961b-0108519c8efd", "row_index": 438, "timestamp": "2019-03-26T17:57:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c378830a-8018-413d-961b-0108519c8efd", "eventTime": "2019-03-26T17:57:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIyYVhQMGgreWkyVFd4MS9uUmdoMHZtZGtpRnhTeEc4OGcvSjFHL1BKUEw0T3ZmZUFEbnVjQncvMGh1dllOT3NEejBFQzZjM085UTVYTUpETm1ieWxnN3ZBWHpsbDl5SWVOd1JONTJkWGJHNDNHV3Nzd0NUMTg2UW45cW92Zkd3SnQ2eXV0SXdUVHJVQ2Rjc0hsQmhhS1p2RGYxUTBWTlNzUDJNbmJDOEJsVHAzUWFacUlLL05LWTEzZHVpMHdrMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe65e9fe-90e2-4cbe-8048-0b1e9a792363", "record_id": "flaws_cloudtrail:0000439:fe65e9fe-90e2-4cbe-8048-0b1e9a792363", "row_index": 439, "timestamp": "2019-03-26T17:57:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe65e9fe-90e2-4cbe-8048-0b1e9a792363", "eventTime": "2019-03-26T17:57:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMOWJrSFVyMmdoZzdaWEc0TzZ6UTNOelN3TTFqNzhTWHRuRS9icjFEVmVHcVVjSnNybjJkRFprNTJBdUpXTDhvUnh1K3djem83azd4MFlLSlFPS1RLSmg0OXMzdjVwNCtPZzBwNy9MZTlTQXhQTWpUMk9NRnpnVTdWL09udnFsb3BNWThJN2t0VC9PRWFqdGJMUExYSWVUWmo3RUJaWXBVZCtlYjRMWGcxa1hETUs0cHcrUGM3K3owOVk2TXl1NjhnRGJJdzEyb3JzdThYbXYxeXpMMk1MOVhlNGlDeVZZPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77892-6036-41ba-9820-07894e43b4", "record_id": "flaws_cloudtrail:0000440:77892-6036-41ba-9820-07894e43b4", "row_index": 440, "timestamp": "2019-03-26T17:57:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77892-6036-41ba-9820-07894e43b4", "eventTime": "2019-03-26T17:57:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzL3VsTTB0UlFWaGdaUTFGajBoNnIzNVV1eWZEcFVJT0lnS1REVXJhcVZoWERQWjFza3RzbmJjRmtKd0pNNEZiMzRER3hyejBGVFhHQTJXUDI5WndGZFZIb0I0cjBQWTJsUkZpdDUxZ2c4L0VKY1dMbXpoZmVoTUY5MzIwaEtNb1lra21ZOGJUUXk4Q3pVcmtxbXgzZzlnTXpCL1lZZmhkbVNwQ211T0tOVTN3RkxSS3RiNTRuTWp2NlFQVWVTND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe65e9fe-90e2-4cbe-8048-0b1e9a792363", "record_id": "flaws_cloudtrail:0000441:fe65e9fe-90e2-4cbe-8048-0b1e9a792363", "row_index": 441, "timestamp": "2019-03-26T17:57:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe65e9fe-90e2-4cbe-8048-0b1e9a792363", "eventTime": "2019-03-26T17:57:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMOWJrSFVyMmdoZzdaWEc0TzZ6UTNOelN3TTFqNzhTWHRuRS9icjFEVmVHcVVjSnNybjJkRFprNTJBdUpXTDhvUnh1K3djem83azd4MFlLSlFPS1RLSmg0OXMzdjVwNCtPZzBwNy9MZTlTQXhQTWpUMk9NRnpnVTdWL09udnFsb3BNWThJN2t0VC9PRWFqdGJMUExYSWVUWmo3RUJaWXBVZCtlYjRMWGcxa1hETUs0cHcrUGM3K3owOVk2TXl1NjhnRGJJdzEyb3JzdThYbXYxeXpMMk1MOVhlNGlDeVZZPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77892-6036-41ba-9820-07894e43b4", "record_id": "flaws_cloudtrail:0000442:77892-6036-41ba-9820-07894e43b4", "row_index": 442, "timestamp": "2019-03-26T17:57:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77892-6036-41ba-9820-07894e43b4", "eventTime": "2019-03-26T17:57:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzL3VsTTB0UlFWaGdaUTFGajBoNnIzNVV1eWZEcFVJT0lnS1REVXJhcVZoWERQWjFza3RzbmJjRmtKd0pNNEZiMzRER3hyejBGVFhHQTJXUDI5WndGZFZIb0I0cjBQWTJsUkZpdDUxZ2c4L0VKY1dMbXpoZmVoTUY5MzIwaEtNb1lra21ZOGJUUXk4Q3pVcmtxbXgzZzlnTXpCL1lZZmhkbVNwQ211T0tOVTN3RkxSS3RiNTRuTWp2NlFQVWVTND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "defba6f9-3bd4-4afe-b69e-854b8043ccb8", "record_id": "flaws_cloudtrail:0000443:defba6f9-3bd4-4afe-b69e-854b8043ccb8", "row_index": 443, "timestamp": "2019-03-26T17:57:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "defba6f9-3bd4-4afe-b69e-854b8043ccb8", "eventTime": "2019-03-26T17:57:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ6eEVEelJiMzV1ZGZhMS9scEJTaEtyRXQzZEJQT1A0TnlRVzFWdzlLT3RtbFcreEJZUE5wQjE4Yzg1NFJ5TTkzcXFjbkhvNkxWR1BqdU03eFI1UWdCNFF4enI3eURvSCtHNlo2U3dkNDlkTWtnenZrZmhjVjZYejN1dnpvbE8rWEVaSXZMcEVSZEp4Vmd0RjFlNGhUdyt2aWgxWFZtY2N6V1J6K0tiMkxqN1B1MkN5c09QaVdybHcvTUZpbS9GQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09ca0b3b-4000-4174-b93d-a7dd8bcba29d", "record_id": "flaws_cloudtrail:0000444:09ca0b3b-4000-4174-b93d-a7dd8bcba29d", "row_index": 444, "timestamp": "2019-03-26T17:57:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09ca0b3b-4000-4174-b93d-a7dd8bcba29d", "eventTime": "2019-03-26T17:57:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGQ3U1djk1Tnc4RnZQRmJNclVaWVlDNE1YdDlRTjgwcndPa0dHRmlCZFVVeGJ4bWFSMWFRV2hzZG5wOG9aYnpLc3VEUERGL3p5L3FpRG9lc0FXbUxwanhvMExyTzVTcTNSVmE0Z2ZxUXZRVlQrclJpR1RXNHhodGdjeDd4aTczaE85UHpSVDNBbjdjZm43UU5NS3hNMHhBWVZMQmZmWDlzTEVZVWNBVVFKUHpEVHVDcXhVOXZaanBzWVkxSEpLbm9vRGVpTHU1bWRvTGEvN0JQZHdDN28yVlFjVCtqTXBBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "defba6f9-3bd4-4afe-b69e-854b8043ccb8", "record_id": "flaws_cloudtrail:0000445:defba6f9-3bd4-4afe-b69e-854b8043ccb8", "row_index": 445, "timestamp": "2019-03-26T17:57:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "defba6f9-3bd4-4afe-b69e-854b8043ccb8", "eventTime": "2019-03-26T17:57:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ6eEVEelJiMzV1ZGZhMS9scEJTaEtyRXQzZEJQT1A0TnlRVzFWdzlLT3RtbFcreEJZUE5wQjE4Yzg1NFJ5TTkzcXFjbkhvNkxWR1BqdU03eFI1UWdCNFF4enI3eURvSCtHNlo2U3dkNDlkTWtnenZrZmhjVjZYejN1dnpvbE8rWEVaSXZMcEVSZEp4Vmd0RjFlNGhUdyt2aWgxWFZtY2N6V1J6K0tiMkxqN1B1MkN5c09QaVdybHcvTUZpbS9GQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09ca0b3b-4000-4174-b93d-a7dd8bcba29d", "record_id": "flaws_cloudtrail:0000446:09ca0b3b-4000-4174-b93d-a7dd8bcba29d", "row_index": 446, "timestamp": "2019-03-26T17:57:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09ca0b3b-4000-4174-b93d-a7dd8bcba29d", "eventTime": "2019-03-26T17:57:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGQ3U1djk1Tnc4RnZQRmJNclVaWVlDNE1YdDlRTjgwcndPa0dHRmlCZFVVeGJ4bWFSMWFRV2hzZG5wOG9aYnpLc3VEUERGL3p5L3FpRG9lc0FXbUxwanhvMExyTzVTcTNSVmE0Z2ZxUXZRVlQrclJpR1RXNHhodGdjeDd4aTczaE85UHpSVDNBbjdjZm43UU5NS3hNMHhBWVZMQmZmWDlzTEVZVWNBVVFKUHpEVHVDcXhVOXZaanBzWVkxSEpLbm9vRGVpTHU1bWRvTGEvN0JQZHdDN28yVlFjVCtqTXBBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7218efef-8cd1-45f5-9a07-677e6b20e229", "record_id": "flaws_cloudtrail:0000447:7218efef-8cd1-45f5-9a07-677e6b20e229", "row_index": 447, "timestamp": "2019-03-26T17:57:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7218efef-8cd1-45f5-9a07-677e6b20e229", "eventTime": "2019-03-26T17:57:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJneEpUWHhka0JSY2pSMzdTTzl6L0NVTWJ5azROYnZPTERjTVZjWDRIRytxUFdxckVrVUY4OWlhWWg1UlR3QzN5Y0dkL1Nxd2RxZStTOS82MjFQWDRzNjRJMnR3Tm9tTjFKeGF6OTFWYVdMazdxMnR3YzF1UElZTk5pUkJtazM3K0F5ZSt2OFVrc2lQU2ZCVmU5UXVzRVJneU83WHJaK0NWU0h5ZHJ2SmdkczlOQWg1T0s3bDA2QXVnNmtTQ2Z3MEFwQkVGMlNBaEdOYzNqUEdERElJaTRaVHJVOFJYd1NjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7218efef-8cd1-45f5-9a07-677e6b20e229", "record_id": "flaws_cloudtrail:0000448:7218efef-8cd1-45f5-9a07-677e6b20e229", "row_index": 448, "timestamp": "2019-03-26T17:57:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7218efef-8cd1-45f5-9a07-677e6b20e229", "eventTime": "2019-03-26T17:57:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJneEpUWHhka0JSY2pSMzdTTzl6L0NVTWJ5azROYnZPTERjTVZjWDRIRytxUFdxckVrVUY4OWlhWWg1UlR3QzN5Y0dkL1Nxd2RxZStTOS82MjFQWDRzNjRJMnR3Tm9tTjFKeGF6OTFWYVdMazdxMnR3YzF1UElZTk5pUkJtazM3K0F5ZSt2OFVrc2lQU2ZCVmU5UXVzRVJneU83WHJaK0NWU0h5ZHJ2SmdkczlOQWg1T0s3bDA2QXVnNmtTQ2Z3MEFwQkVGMlNBaEdOYzNqUEdERElJaTRaVHJVOFJYd1NjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bdce11c-9471-404f-b265-d621f95c6218", "record_id": "flaws_cloudtrail:0000449:9bdce11c-9471-404f-b265-d621f95c6218", "row_index": 449, "timestamp": "2019-03-26T17:57:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bdce11c-9471-404f-b265-d621f95c6218", "eventTime": "2019-03-26T17:57:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5Q3l5YkNVTmFvaXc4MEpLMjhjdmE4OTJlZXdSRlYvV1dGUnpTZEk0VnR3TE5NdWNHNkJ4WXRVdGoxQkpaSG9HM3ZBV2tlU0VSZmVZV21mOUF2ejJ6QW83WVFsVTNLUDR1ejk2aWxWQVdyOGpuQ016R1ZsaEYzS3MrbEwrbTlIT1FwMVVtODRkZW9XQWs1YWNWSmJvd1VyUGNYb2d3dnhzWCtYb2RUS2U0ZHVPNDFmNWJtUmg5d1hRbS9OY2R0RT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bdce11c-9471-404f-b265-d621f95c6218", "record_id": "flaws_cloudtrail:0000450:9bdce11c-9471-404f-b265-d621f95c6218", "row_index": 450, "timestamp": "2019-03-26T17:57:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bdce11c-9471-404f-b265-d621f95c6218", "eventTime": "2019-03-26T17:57:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5Q3l5YkNVTmFvaXc4MEpLMjhjdmE4OTJlZXdSRlYvV1dGUnpTZEk0VnR3TE5NdWNHNkJ4WXRVdGoxQkpaSG9HM3ZBV2tlU0VSZmVZV21mOUF2ejJ6QW83WVFsVTNLUDR1ejk2aWxWQVdyOGpuQ016R1ZsaEYzS3MrbEwrbTlIT1FwMVVtODRkZW9XQWs1YWNWSmJvd1VyUGNYb2d3dnhzWCtYb2RUS2U0ZHVPNDFmNWJtUmg5d1hRbS9OY2R0RT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8edef9cb-7ad2-4c58-835c-5226bc2767f8", "record_id": "flaws_cloudtrail:0000451:8edef9cb-7ad2-4c58-835c-5226bc2767f8", "row_index": 451, "timestamp": "2019-03-26T17:57:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8edef9cb-7ad2-4c58-835c-5226bc2767f8", "eventTime": "2019-03-26T17:57:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4aVBWVDZIOWdHS010UVdvWTB5ay85M09iQldvaitGT0ppYnFSRWRyeHNGMW5YOUp3QzdCN1hQeVpXMDhJZERWbXVyRk5CQ1hTMVQ2STFIaWJpV1QxN1dTSGgwVHQybkxzVjAvMDcrSjdtSmMyNEtaODNqaW5BRkdod0dUTlVienVBOGV2STRhTlcwNlJ0SXVuT1gzYWhMMEVpa2VUVzVkcnYza29ZdmxGdzdlWlRCVi9VQkNZNnlkcTdQTHZvcXZwOTAvdXJ4ZnFlMGhlK01NS1hUVXZqM0tRWWtPZms0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8edef9cb-7ad2-4c58-835c-5226bc2767f8", "record_id": "flaws_cloudtrail:0000452:8edef9cb-7ad2-4c58-835c-5226bc2767f8", "row_index": 452, "timestamp": "2019-03-26T17:57:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8edef9cb-7ad2-4c58-835c-5226bc2767f8", "eventTime": "2019-03-26T17:57:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4aVBWVDZIOWdHS010UVdvWTB5ay85M09iQldvaitGT0ppYnFSRWRyeHNGMW5YOUp3QzdCN1hQeVpXMDhJZERWbXVyRk5CQ1hTMVQ2STFIaWJpV1QxN1dTSGgwVHQybkxzVjAvMDcrSjdtSmMyNEtaODNqaW5BRkdod0dUTlVienVBOGV2STRhTlcwNlJ0SXVuT1gzYWhMMEVpa2VUVzVkcnYza29ZdmxGdzdlWlRCVi9VQkNZNnlkcTdQTHZvcXZwOTAvdXJ4ZnFlMGhlK01NS1hUVXZqM0tRWWtPZms0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2dc7efa2-aaf6-42dc-83a2-078eed099c7b", "record_id": "flaws_cloudtrail:0000453:2dc7efa2-aaf6-42dc-83a2-078eed099c7b", "row_index": 453, "timestamp": "2019-03-26T17:57:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2dc7efa2-aaf6-42dc-83a2-078eed099c7b", "eventTime": "2019-03-26T17:57:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJibEo4SW1wNDZQaXZOMUhIb1NwLzZFUmk2bzdzMjRRQWlGTzgwY0FRYks1NU1hYkhuQ0FvcGlyQ09PK0RDbXpjQ3QwSmRJbWI5NTh5Rlk2SnU2S29RY0FiL1VxZUhMRTlVcFlvWERtNHRyU1ljclprRFNJa3FLT0VwTXdNQTJGYkIvK2pialpNci95dm5TSFlFVHlwZmVuUk1yWFRTNHJvcUxxMHNTZi9oQ0JQMlNhL0lIVVdzakpiZ3d3a09PND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2dc7efa2-aaf6-42dc-83a2-078eed099c7b", "record_id": "flaws_cloudtrail:0000454:2dc7efa2-aaf6-42dc-83a2-078eed099c7b", "row_index": 454, "timestamp": "2019-03-26T17:57:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2dc7efa2-aaf6-42dc-83a2-078eed099c7b", "eventTime": "2019-03-26T17:57:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJibEo4SW1wNDZQaXZOMUhIb1NwLzZFUmk2bzdzMjRRQWlGTzgwY0FRYks1NU1hYkhuQ0FvcGlyQ09PK0RDbXpjQ3QwSmRJbWI5NTh5Rlk2SnU2S29RY0FiL1VxZUhMRTlVcFlvWERtNHRyU1ljclprRFNJa3FLT0VwTXdNQTJGYkIvK2pialpNci95dm5TSFlFVHlwZmVuUk1yWFRTNHJvcUxxMHNTZi9oQ0JQMlNhL0lIVVdzakpiZ3d3a09PND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3debe095-1792-4cde-8104-dd2bee4eaf0f", "record_id": "flaws_cloudtrail:0000455:3debe095-1792-4cde-8104-dd2bee4eaf0f", "row_index": 455, "timestamp": "2019-03-26T17:58:17Z", "event_type": "ListPolicyVersions", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3debe095-1792-4cde-8104-dd2bee4eaf0f", "eventTime": "2019-03-26T17:58:17Z", "eventName": "ListPolicyVersions", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3debe095-1792-4cde-8104-dd2bee4eaf0f", "record_id": "flaws_cloudtrail:0000456:3debe095-1792-4cde-8104-dd2bee4eaf0f", "row_index": 456, "timestamp": "2019-03-26T17:58:17Z", "event_type": "ListPolicyVersions", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3debe095-1792-4cde-8104-dd2bee4eaf0f", "eventTime": "2019-03-26T17:58:17Z", "eventName": "ListPolicyVersions", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "405c51ee-bdef-4ac5-8dda-3e920354b858", "record_id": "flaws_cloudtrail:0000457:405c51ee-bdef-4ac5-8dda-3e920354b858", "row_index": 457, "timestamp": "2019-03-26T17:58:29Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "405c51ee-bdef-4ac5-8dda-3e920354b858", "eventTime": "2019-03-26T17:58:29Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "405c51ee-bdef-4ac5-8dda-3e920354b858", "record_id": "flaws_cloudtrail:0000458:405c51ee-bdef-4ac5-8dda-3e920354b858", "row_index": 458, "timestamp": "2019-03-26T17:58:29Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "405c51ee-bdef-4ac5-8dda-3e920354b858", "eventTime": "2019-03-26T17:58:29Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cac5f7ed-3dfc-4bc8-83cc-3e5dc18c9c5d", "record_id": "flaws_cloudtrail:0000459:cac5f7ed-3dfc-4bc8-83cc-3e5dc18c9c5d", "row_index": 459, "timestamp": "2019-03-26T17:59:58Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1169, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cac5f7ed-3dfc-4bc8-83cc-3e5dc18c9c5d", "eventTime": "2019-03-26T17:59:58Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cac5f7ed-3dfc-4bc8-83cc-3e5dc18c9c5d", "record_id": "flaws_cloudtrail:0000460:cac5f7ed-3dfc-4bc8-83cc-3e5dc18c9c5d", "row_index": 460, "timestamp": "2019-03-26T17:59:58Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1169, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cac5f7ed-3dfc-4bc8-83cc-3e5dc18c9c5d", "eventTime": "2019-03-26T17:59:58Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "[aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c659db-ea2c-4b0e-98a1-76f586238c51a", "record_id": "flaws_cloudtrail:0000461:f8c659db-ea2c-4b0e-98a1-76f586238c51a", "row_index": 461, "timestamp": "2019-03-26T18:00:21Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1111, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c659db-ea2c-4b0e-98a1-76f586238c51a", "eventTime": "2019-03-26T18:00:21Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c659db-ea2c-4b0e-98a1-76f586238c51a", "record_id": "flaws_cloudtrail:0000462:f8c659db-ea2c-4b0e-98a1-76f586238c51a", "row_index": 462, "timestamp": "2019-03-26T18:00:21Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1111, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c659db-ea2c-4b0e-98a1-76f586238c51a", "eventTime": "2019-03-26T18:00:21Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c9273f8-7c72-4adc-93e2-b732223d13b", "record_id": "flaws_cloudtrail:0000463:1c9273f8-7c72-4adc-93e2-b732223d13b", "row_index": 463, "timestamp": "2019-03-26T18:00:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c9273f8-7c72-4adc-93e2-b732223d13b", "eventTime": "2019-03-26T18:00:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "description", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c9273f8-7c72-4adc-93e2-b732223d13b", "record_id": "flaws_cloudtrail:0000464:1c9273f8-7c72-4adc-93e2-b732223d13b", "row_index": 464, "timestamp": "2019-03-26T18:00:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c9273f8-7c72-4adc-93e2-b732223d13b", "eventTime": "2019-03-26T18:00:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "description", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d4fbedc-1735-4d84-bb78-5f823665eee5", "record_id": "flaws_cloudtrail:0000465:3d4fbedc-1735-4d84-bb78-5f823665eee5", "row_index": 465, "timestamp": "2019-03-26T18:02:45Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d4fbedc-1735-4d84-bb78-5f823665eee5", "eventTime": "2019-03-26T18:02:45Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d4fbedc-1735-4d84-bb78-5f823665eee5", "record_id": "flaws_cloudtrail:0000466:3d4fbedc-1735-4d84-bb78-5f823665eee5", "row_index": 466, "timestamp": "2019-03-26T18:02:45Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d4fbedc-1735-4d84-bb78-5f823665eee5", "eventTime": "2019-03-26T18:02:45Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2bdebe0-52b6-48be-9670-657f7e484cc7", "record_id": "flaws_cloudtrail:0000467:c2bdebe0-52b6-48be-9670-657f7e484cc7", "row_index": 467, "timestamp": "2019-03-26T18:02:46Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2bdebe0-52b6-48be-9670-657f7e484cc7", "eventTime": "2019-03-26T18:02:46Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2bdebe0-52b6-48be-9670-657f7e484cc7", "record_id": "flaws_cloudtrail:0000468:c2bdebe0-52b6-48be-9670-657f7e484cc7", "row_index": 468, "timestamp": "2019-03-26T18:02:46Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2bdebe0-52b6-48be-9670-657f7e484cc7", "eventTime": "2019-03-26T18:02:46Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "[aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59e643db-d793-482f-a7e1-1c19071c13bd", "record_id": "flaws_cloudtrail:0000469:59e643db-d793-482f-a7e1-1c19071c13bd", "row_index": 469, "timestamp": "2019-03-26T18:02:56Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59e643db-d793-482f-a7e1-1c19071c13bd", "eventTime": "2019-03-26T18:02:56Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListRoles on resource: arn:aws:iam::811596193553:role/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59e643db-d793-482f-a7e1-1c19071c13bd", "record_id": "flaws_cloudtrail:0000470:59e643db-d793-482f-a7e1-1c19071c13bd", "row_index": 470, "timestamp": "2019-03-26T18:02:56Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59e643db-d793-482f-a7e1-1c19071c13bd", "eventTime": "2019-03-26T18:02:56Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListRoles on resource: arn:aws:iam::811596193553:role/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0770ef4-63fa-4f09-a5a7-d221bda2b34d", "record_id": "flaws_cloudtrail:0000471:c0770ef4-63fa-4f09-a5a7-d221bda2b34d", "row_index": 471, "timestamp": "2019-03-26T18:03:01Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0770ef4-63fa-4f09-a5a7-d221bda2b34d", "eventTime": "2019-03-26T18:03:01Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0770ef4-63fa-4f09-a5a7-d221bda2b34d", "record_id": "flaws_cloudtrail:0000472:c0770ef4-63fa-4f09-a5a7-d221bda2b34d", "row_index": 472, "timestamp": "2019-03-26T18:03:01Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0770ef4-63fa-4f09-a5a7-d221bda2b34d", "eventTime": "2019-03-26T18:03:01Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef744dde-e360-4df9-ba39-083ac327f0c4", "record_id": "flaws_cloudtrail:0000473:ef744dde-e360-4df9-ba39-083ac327f0c4", "row_index": 473, "timestamp": "2019-03-26T18:04:11Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef744dde-e360-4df9-ba39-083ac327f0c4", "eventTime": "2019-03-26T18:04:11Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListUsers on resource: arn:aws:iam::811596193553:user/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef744dde-e360-4df9-ba39-083ac327f0c4", "record_id": "flaws_cloudtrail:0000474:ef744dde-e360-4df9-ba39-083ac327f0c4", "row_index": 474, "timestamp": "2019-03-26T18:04:11Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef744dde-e360-4df9-ba39-083ac327f0c4", "eventTime": "2019-03-26T18:04:11Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListUsers on resource: arn:aws:iam::811596193553:user/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92943d-dc0b-4f69-9479-1942ee8a44ab", "record_id": "flaws_cloudtrail:0000475:92943d-dc0b-4f69-9479-1942ee8a44ab", "row_index": 475, "timestamp": "2019-03-26T18:06:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92943d-dc0b-4f69-9479-1942ee8a44ab", "eventTime": "2019-03-26T18:06:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'OwnerId' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "OwnerId", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92943d-dc0b-4f69-9479-1942ee8a44ab", "record_id": "flaws_cloudtrail:0000476:92943d-dc0b-4f69-9479-1942ee8a44ab", "row_index": 476, "timestamp": "2019-03-26T18:06:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92943d-dc0b-4f69-9479-1942ee8a44ab", "eventTime": "2019-03-26T18:06:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'OwnerId' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "OwnerId", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4f398c5-4d83-4985-b7b4-ea54608ef5f", "record_id": "flaws_cloudtrail:0000477:a4f398c5-4d83-4985-b7b4-ea54608ef5f", "row_index": 477, "timestamp": "2019-03-26T18:06:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4f398c5-4d83-4985-b7b4-ea54608ef5f", "eventTime": "2019-03-26T18:06:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "description", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4f398c5-4d83-4985-b7b4-ea54608ef5f", "record_id": "flaws_cloudtrail:0000478:a4f398c5-4d83-4985-b7b4-ea54608ef5f", "row_index": 478, "timestamp": "2019-03-26T18:06:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4f398c5-4d83-4985-b7b4-ea54608ef5f", "eventTime": "2019-03-26T18:06:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "description", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07362f8-4482-4b64-ae21-f4e63c6f870a", "record_id": "flaws_cloudtrail:0000479:07362f8-4482-4b64-ae21-f4e63c6f870a", "row_index": 479, "timestamp": "2019-03-26T18:08:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07362f8-4482-4b64-ae21-f4e63c6f870a", "eventTime": "2019-03-26T18:08:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07362f8-4482-4b64-ae21-f4e63c6f870a", "record_id": "flaws_cloudtrail:0000480:07362f8-4482-4b64-ae21-f4e63c6f870a", "row_index": 480, "timestamp": "2019-03-26T18:08:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07362f8-4482-4b64-ae21-f4e63c6f870a", "eventTime": "2019-03-26T18:08:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a66ca04e-4f49-419e-a992-2108b02ad08c", "record_id": "flaws_cloudtrail:0000481:a66ca04e-4f49-419e-a992-2108b02ad08c", "row_index": 481, "timestamp": "2019-03-26T18:09:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a66ca04e-4f49-419e-a992-2108b02ad08c", "eventTime": "2019-03-26T18:09:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'OwnerId' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "OwnerId", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a66ca04e-4f49-419e-a992-2108b02ad08c", "record_id": "flaws_cloudtrail:0000482:a66ca04e-4f49-419e-a992-2108b02ad08c", "row_index": 482, "timestamp": "2019-03-26T18:09:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a66ca04e-4f49-419e-a992-2108b02ad08c", "eventTime": "2019-03-26T18:09:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'OwnerId' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "OwnerId", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ed174649-9f3b-4b68-bf03-9fc4241a1674", "record_id": "flaws_cloudtrail:0000483:7ed174649-9f3b-4b68-bf03-9fc4241a1674", "row_index": 483, "timestamp": "2019-03-26T18:09:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ed174649-9f3b-4b68-bf03-9fc4241a1674", "eventTime": "2019-03-26T18:09:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ed174649-9f3b-4b68-bf03-9fc4241a1674", "record_id": "flaws_cloudtrail:0000484:7ed174649-9f3b-4b68-bf03-9fc4241a1674", "row_index": 484, "timestamp": "2019-03-26T18:09:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ed174649-9f3b-4b68-bf03-9fc4241a1674", "eventTime": "2019-03-26T18:09:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1465fab-ae2b-4927-bef3-3eba8d6c022c", "record_id": "flaws_cloudtrail:0000485:e1465fab-ae2b-4927-bef3-3eba8d6c022c", "row_index": 485, "timestamp": "2019-03-26T18:09:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1465fab-ae2b-4927-bef3-3eba8d6c022c", "eventTime": "2019-03-26T18:09:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSMlVxVFlURnNGcmFBNlc4QmYyM2dYM0MzeitaNnNZRDZGRzdwOTAzWmNpWU9OR1dCSDJNMThPbVJadWlhL3IwclkycVRjeW8xazUycUZMdjNIN1NYWWV4d2dzVlVYNGRjK3pxS1F3TFVSS3NwZ1hicTVpdk1iTUlpNitFaGZwVkNPWTdsV1drZ2pGUFZLaVJQWGJpM3BPM0ZaRmNmNXhIQWplRWRXemwyeFFrVHRPald3bVlVbXh1aHdYbmFEaFFPejJJM200NFpLZFdIdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1465fab-ae2b-4927-bef3-3eba8d6c022c", "record_id": "flaws_cloudtrail:0000486:e1465fab-ae2b-4927-bef3-3eba8d6c022c", "row_index": 486, "timestamp": "2019-03-26T18:09:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1465fab-ae2b-4927-bef3-3eba8d6c022c", "eventTime": "2019-03-26T18:09:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSMlVxVFlURnNGcmFBNlc4QmYyM2dYM0MzeitaNnNZRDZGRzdwOTAzWmNpWU9OR1dCSDJNMThPbVJadWlhL3IwclkycVRjeW8xazUycUZMdjNIN1NYWWV4d2dzVlVYNGRjK3pxS1F3TFVSS3NwZ1hicTVpdk1iTUlpNitFaGZwVkNPWTdsV1drZ2pGUFZLaVJQWGJpM3BPM0ZaRmNmNXhIQWplRWRXemwyeFFrVHRPald3bVlVbXh1aHdYbmFEaFFPejJJM200NFpLZFdIdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "591400c-c48e-41d8-aa5f-7268c48f7daa", "record_id": "flaws_cloudtrail:0000487:591400c-c48e-41d8-aa5f-7268c48f7daa", "row_index": 487, "timestamp": "2019-03-26T18:10:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1082, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "591400c-c48e-41d8-aa5f-7268c48f7daa", "eventTime": "2019-03-26T18:10:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJdFJscEF0dDViN0ZTWHYvd1N6S1JOTzVKVWZVaFJFekhJMjZsbUFyck5qZjJyaXJwRFdtb1pldVAyejFLZDd5UGxlVys5NUVqVFM4MGNMQnFkRnpPc08wRHFNUUxjbTBHZWJKN3pNNzhPZXNBUHhHZ0hPcHhTWmhSWDJ6VE8vWnhCOCtQYnNCckV3VlZ4cTNjZFFXaGNJYXFsZCtwTy91eFZvQWlxQXhpRDBsRENEU29BTGxWNzM0Vk1DcHB0bk52MzlvNzlOSEJPalFjdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "591400c-c48e-41d8-aa5f-7268c48f7daa", "record_id": "flaws_cloudtrail:0000488:591400c-c48e-41d8-aa5f-7268c48f7daa", "row_index": 488, "timestamp": "2019-03-26T18:10:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1082, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "591400c-c48e-41d8-aa5f-7268c48f7daa", "eventTime": "2019-03-26T18:10:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJdFJscEF0dDViN0ZTWHYvd1N6S1JOTzVKVWZVaFJFekhJMjZsbUFyck5qZjJyaXJwRFdtb1pldVAyejFLZDd5UGxlVys5NUVqVFM4MGNMQnFkRnpPc08wRHFNUUxjbTBHZWJKN3pNNzhPZXNBUHhHZ0hPcHhTWmhSWDJ6VE8vWnhCOCtQYnNCckV3VlZ4cTNjZFFXaGNJYXFsZCtwTy91eFZvQWlxQXhpRDBsRENEU29BTGxWNzM0Vk1DcHB0bk52MzlvNzlOSEJPalFjdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a29db57b-f791-4c8f-b034-97e1c172caba", "record_id": "flaws_cloudtrail:0000489:a29db57b-f791-4c8f-b034-97e1c172caba", "row_index": 489, "timestamp": "2019-03-26T18:10:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a29db57b-f791-4c8f-b034-97e1c172caba", "eventTime": "2019-03-26T18:10:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTeTNLU3ZuenFRWURjdlBEMkRHcHpYUkxoUkpDaFkwaDc1K2h3Z1VueHJDSmNaUHhWa3g5a2F2YWlMdXRhU2ZEdzJVK2h4a1p3UlB6SDRmOFNlRnIvNE5ENDFTRk9HalExYW9WYUIvcGRZcUpYc2daaW1kdE9OWXQ0U0RiSGR6T0pVN1FZRnRGUVFoSHVNOGNUbXpBdTNPNS9vcjJsT2Q1VDRCTC90YjFDeWl2RDB3dVFweWh4VE05bjhVeEtnTkI4ODR4bURkajdRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a29db57b-f791-4c8f-b034-97e1c172caba", "record_id": "flaws_cloudtrail:0000490:a29db57b-f791-4c8f-b034-97e1c172caba", "row_index": 490, "timestamp": "2019-03-26T18:10:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a29db57b-f791-4c8f-b034-97e1c172caba", "eventTime": "2019-03-26T18:10:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTeTNLU3ZuenFRWURjdlBEMkRHcHpYUkxoUkpDaFkwaDc1K2h3Z1VueHJDSmNaUHhWa3g5a2F2YWlMdXRhU2ZEdzJVK2h4a1p3UlB6SDRmOFNlRnIvNE5ENDFTRk9HalExYW9WYUIvcGRZcUpYc2daaW1kdE9OWXQ0U0RiSGR6T0pVN1FZRnRGUVFoSHVNOGNUbXpBdTNPNS9vcjJsT2Q1VDRCTC90YjFDeWl2RDB3dVFweWh4VE05bjhVeEtnTkI4ODR4bURkajdRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f71332a-8c01-468e-a5cf-35a5daf55e50", "record_id": "flaws_cloudtrail:0000491:1f71332a-8c01-468e-a5cf-35a5daf55e50", "row_index": 491, "timestamp": "2019-03-26T18:10:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f71332a-8c01-468e-a5cf-35a5daf55e50", "eventTime": "2019-03-26T18:10:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzdmxlallRSkZRMnB2L2VpWFAwM00yREh3Y3NGcjJUUGczNG4rdGp6K0pVcnhlZnNkWHlHcVI2Nm9tck5Ub3gwa3BiTllabXRnWklhZzhxd1hISUtDTDIvd1NSdmRGbE1VN20xV1g4OFY4emVLUUMydmQvNnJZZjNCMVovODh2enZwZVk2Y1dBbmM3dU9mMU1md0VUajNCd1hOQnU3OXo4c01UZCtmcUsxNlB3TWp4Z01yR1ZDWkIraXZzc3NjWVVLZzZFMXBBbHFHNTA5QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f71332a-8c01-468e-a5cf-35a5daf55e50", "record_id": "flaws_cloudtrail:0000492:1f71332a-8c01-468e-a5cf-35a5daf55e50", "row_index": 492, "timestamp": "2019-03-26T18:10:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f71332a-8c01-468e-a5cf-35a5daf55e50", "eventTime": "2019-03-26T18:10:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzdmxlallRSkZRMnB2L2VpWFAwM00yREh3Y3NGcjJUUGczNG4rdGp6K0pVcnhlZnNkWHlHcVI2Nm9tck5Ub3gwa3BiTllabXRnWklhZzhxd1hISUtDTDIvd1NSdmRGbE1VN20xV1g4OFY4emVLUUMydmQvNnJZZjNCMVovODh2enZwZVk2Y1dBbmM3dU9mMU1md0VUajNCd1hOQnU3OXo4c01UZCtmcUsxNlB3TWp4Z01yR1ZDWkIraXZzc3NjWVVLZzZFMXBBbHFHNTA5QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0474eff-22e4-418d-8ecc-1c4f8abf8ed7", "record_id": "flaws_cloudtrail:0000493:c0474eff-22e4-418d-8ecc-1c4f8abf8ed7", "row_index": 493, "timestamp": "2019-03-26T18:10:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0474eff-22e4-418d-8ecc-1c4f8abf8ed7", "eventTime": "2019-03-26T18:10:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3N3pJV2pQYWZvb1hzRldjdEJncGVwb0x6a0hINVJHRnpXZ3hoQUVGQW1kbE9FcGk2OThxTzRpMGJuQTB5NTF5Z3V5T1BVME96SGlkSUlKVVhrVGhWeWJhQ3BYdXBrUkcrb3owbzVlc04yeDdvbC9KQ2ZGdVRpMGZTOXpUMFJ5RldEUCtzTWQ0MnZGenNLcG9DWHhMMnEzWVhYbFNnK05SRkZHWWdYQWwrL2x2NWJaM2VNaWh1S2lSWG12S2JCeCtLTnQwakxzYzI1d21xZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0474eff-22e4-418d-8ecc-1c4f8abf8ed7", "record_id": "flaws_cloudtrail:0000494:c0474eff-22e4-418d-8ecc-1c4f8abf8ed7", "row_index": 494, "timestamp": "2019-03-26T18:10:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0474eff-22e4-418d-8ecc-1c4f8abf8ed7", "eventTime": "2019-03-26T18:10:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3N3pJV2pQYWZvb1hzRldjdEJncGVwb0x6a0hINVJHRnpXZ3hoQUVGQW1kbE9FcGk2OThxTzRpMGJuQTB5NTF5Z3V5T1BVME96SGlkSUlKVVhrVGhWeWJhQ3BYdXBrUkcrb3owbzVlc04yeDdvbC9KQ2ZGdVRpMGZTOXpUMFJ5RldEUCtzTWQ0MnZGenNLcG9DWHhMMnEzWVhYbFNnK05SRkZHWWdYQWwrL2x2NWJaM2VNaWh1S2lSWG12S2JCeCtLTnQwakxzYzI1d21xZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d404f23e-5b71-4e89-9b24-59c5fd1f7adc", "record_id": "flaws_cloudtrail:0000495:d404f23e-5b71-4e89-9b24-59c5fd1f7adc", "row_index": 495, "timestamp": "2019-03-26T18:10:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d404f23e-5b71-4e89-9b24-59c5fd1f7adc", "eventTime": "2019-03-26T18:10:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYVFVsY3VkNWVVbzlKdFAzTTcza2lqZTJKR1VKeTFvZitsb3Fra2xib2hrY29UV3UydWVZRkVrVlBzSG56TmVSZTE5SHRGUlFYVTVia1NjMUdkSDh2VkViMEgxN2Y5aEhDMGhUdnJac0NPcmJPZnpiQXNjTGJ4cEM3R3RQSFVLQmh6eVBGaWlCenJxMVg3Q0lMeW9aY2RxTmJ4SXYva2h4bzlPY0dJaWViK3diZW9ocEVXaHcxRjdZYVFCVCtpR0Y4UkFTNkZibmNJYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d404f23e-5b71-4e89-9b24-59c5fd1f7adc", "record_id": "flaws_cloudtrail:0000496:d404f23e-5b71-4e89-9b24-59c5fd1f7adc", "row_index": 496, "timestamp": "2019-03-26T18:10:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d404f23e-5b71-4e89-9b24-59c5fd1f7adc", "eventTime": "2019-03-26T18:10:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYVFVsY3VkNWVVbzlKdFAzTTcza2lqZTJKR1VKeTFvZitsb3Fra2xib2hrY29UV3UydWVZRkVrVlBzSG56TmVSZTE5SHRGUlFYVTVia1NjMUdkSDh2VkViMEgxN2Y5aEhDMGhUdnJac0NPcmJPZnpiQXNjTGJ4cEM3R3RQSFVLQmh6eVBGaWlCenJxMVg3Q0lMeW9aY2RxTmJ4SXYva2h4bzlPY0dJaWViK3diZW9ocEVXaHcxRjdZYVFCVCtpR0Y4UkFTNkZibmNJYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52847ba-bc76-4e9f-8830-729191cf55bc4", "record_id": "flaws_cloudtrail:0000497:52847ba-bc76-4e9f-8830-729191cf55bc4", "row_index": 497, "timestamp": "2019-03-26T18:10:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52847ba-bc76-4e9f-8830-729191cf55bc4", "eventTime": "2019-03-26T18:10:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSNGxmOVd2eVp0ZjAraFVnQmMvblY0NitpVC9KelREMmxYWTZGNG5CY2xwUnQ3dExpM0twbzlmRkNNUG9mNFNlN01DR3JMOWlObFJmNlZMUlRsWHVLNEVGQkNvaWhVamY5N1lwVy92dVhoZ2F6cUVhOEluTlRIREd0RW9ETkMvbzBHR014eXJnY2VTWDZDbXI1KzJPN0lwT2pjTjloSVV6OWRNbTliRzhqQW8zdVVZQVRiV29kRzJhdC85bzMyM1B6YTMvNFVOcU5HQmZtZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52847ba-bc76-4e9f-8830-729191cf55bc4", "record_id": "flaws_cloudtrail:0000498:52847ba-bc76-4e9f-8830-729191cf55bc4", "row_index": 498, "timestamp": "2019-03-26T18:10:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52847ba-bc76-4e9f-8830-729191cf55bc4", "eventTime": "2019-03-26T18:10:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSNGxmOVd2eVp0ZjAraFVnQmMvblY0NitpVC9KelREMmxYWTZGNG5CY2xwUnQ3dExpM0twbzlmRkNNUG9mNFNlN01DR3JMOWlObFJmNlZMUlRsWHVLNEVGQkNvaWhVamY5N1lwVy92dVhoZ2F6cUVhOEluTlRIREd0RW9ETkMvbzBHR014eXJnY2VTWDZDbXI1KzJPN0lwT2pjTjloSVV6OWRNbTliRzhqQW8zdVVZQVRiV29kRzJhdC85bzMyM1B6YTMvNFVOcU5HQmZtZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "088aaaf4-89d1-4fce-b21c-a8a4f4d8ddab", "record_id": "flaws_cloudtrail:0000499:088aaaf4-89d1-4fce-b21c-a8a4f4d8ddab", "row_index": 499, "timestamp": "2019-03-26T18:10:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "088aaaf4-89d1-4fce-b21c-a8a4f4d8ddab", "eventTime": "2019-03-26T18:10:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwemxYaHFWT1M0TTFtNU5oa3dYOW4wZzkvaTFRYkZsNndJdnZZTFN0VHVEOHg5S2U1elhNdFdtd2hTQUdhNnMvZEc1THJMUHU0cXBwa1ZrMjhaSUJrY3JBTnFkSDlRU3BsdkZUeVdtQU9mdXlHWGhRdlhoYlgwQmprLzMzSnpEVldET0w1Q1VhSlpNMUl0OTZaZFZVQUY1c2FvYlN6R3p0OFRJTi9tY0JWUHNqbk1ib21XWWh4WmRtMFNvR1pBbk0vZ1dVbkhXT1YwNHQ4QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "088aaaf4-89d1-4fce-b21c-a8a4f4d8ddab", "record_id": "flaws_cloudtrail:0000500:088aaaf4-89d1-4fce-b21c-a8a4f4d8ddab", "row_index": 500, "timestamp": "2019-03-26T18:10:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "088aaaf4-89d1-4fce-b21c-a8a4f4d8ddab", "eventTime": "2019-03-26T18:10:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwemxYaHFWT1M0TTFtNU5oa3dYOW4wZzkvaTFRYkZsNndJdnZZTFN0VHVEOHg5S2U1elhNdFdtd2hTQUdhNnMvZEc1THJMUHU0cXBwa1ZrMjhaSUJrY3JBTnFkSDlRU3BsdkZUeVdtQU9mdXlHWGhRdlhoYlgwQmprLzMzSnpEVldET0w1Q1VhSlpNMUl0OTZaZFZVQUY1c2FvYlN6R3p0OFRJTi9tY0JWUHNqbk1ib21XWWh4WmRtMFNvR1pBbk0vZ1dVbkhXT1YwNHQ4QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bffffeb6-77f1-4b60-aac9-bd17b2b8f22c", "record_id": "flaws_cloudtrail:0000501:bffffeb6-77f1-4b60-aac9-bd17b2b8f22c", "row_index": 501, "timestamp": "2019-03-26T18:10:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bffffeb6-77f1-4b60-aac9-bd17b2b8f22c", "eventTime": "2019-03-26T18:10:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCdjBab1lmcmxKYS9MdHY4UXNUelNTTnlXUm4rSWRKaWN6d2h5d0x0WENYMUJKQW45RlJQc3N0b3QzOG9zME1pWVlRa0pSNGdHZllQN3lGSnRXdTB3dkozaUZDSkhjSkR3UkE0bXY2dUxRZTFzOVl4VmI1cVBDaUpVYkRyUytHaGpHMG1SY3JKeEZqTzBjU1FtV0hiUlNGVDFTMUpYRmhCdkZ4dGl1bW9oK0lLMjhmYVBWWGJKcEtwUFFBRGlDeHpGMjhZUzlZcUJnK2ovZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bffffeb6-77f1-4b60-aac9-bd17b2b8f22c", "record_id": "flaws_cloudtrail:0000502:bffffeb6-77f1-4b60-aac9-bd17b2b8f22c", "row_index": 502, "timestamp": "2019-03-26T18:10:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bffffeb6-77f1-4b60-aac9-bd17b2b8f22c", "eventTime": "2019-03-26T18:10:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCdjBab1lmcmxKYS9MdHY4UXNUelNTTnlXUm4rSWRKaWN6d2h5d0x0WENYMUJKQW45RlJQc3N0b3QzOG9zME1pWVlRa0pSNGdHZllQN3lGSnRXdTB3dkozaUZDSkhjSkR3UkE0bXY2dUxRZTFzOVl4VmI1cVBDaUpVYkRyUytHaGpHMG1SY3JKeEZqTzBjU1FtV0hiUlNGVDFTMUpYRmhCdkZ4dGl1bW9oK0lLMjhmYVBWWGJKcEtwUFFBRGlDeHpGMjhZUzlZcUJnK2ovZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac7d6f6d-873d-468d-bc71-c27ec06fecb3", "record_id": "flaws_cloudtrail:0000503:ac7d6f6d-873d-468d-bc71-c27ec06fecb3", "row_index": 503, "timestamp": "2019-03-26T18:10:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac7d6f6d-873d-468d-bc71-c27ec06fecb3", "eventTime": "2019-03-26T18:10:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXQ0gyUU85eUFuYm50SktLcG1NY0M1NEZtVFJ1alNUMEVzY2s5dTlBalo5YWlGWDZGQWRuNGVTTXZLTVYrM3ZyOUZvYTN6OTAxTUt6SU96aGxCY3ljUHZIU21EZEF2NG5wVnVDRmJtQTBCczNBUmFmREpXNldnK29oMDRMUHNEQ2pGRVJ5WHFFSkczRjkyZncrRkNqQVk4VVdYdkt1RXFnSHBiaXNBWVYvbXU1OGM1bThiR0MrNmhqUDN2eng5V2Urb3BGRDFlQmI5b0lsQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac7d6f6d-873d-468d-bc71-c27ec06fecb3", "record_id": "flaws_cloudtrail:0000504:ac7d6f6d-873d-468d-bc71-c27ec06fecb3", "row_index": 504, "timestamp": "2019-03-26T18:10:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac7d6f6d-873d-468d-bc71-c27ec06fecb3", "eventTime": "2019-03-26T18:10:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXQ0gyUU85eUFuYm50SktLcG1NY0M1NEZtVFJ1alNUMEVzY2s5dTlBalo5YWlGWDZGQWRuNGVTTXZLTVYrM3ZyOUZvYTN6OTAxTUt6SU96aGxCY3ljUHZIU21EZEF2NG5wVnVDRmJtQTBCczNBUmFmREpXNldnK29oMDRMUHNEQ2pGRVJ5WHFFSkczRjkyZncrRkNqQVk4VVdYdkt1RXFnSHBiaXNBWVYvbXU1OGM1bThiR0MrNmhqUDN2eng5V2Urb3BGRDFlQmI5b0lsQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af8ebcd2-60a3-45f5-b932-3f78f8653e06", "record_id": "flaws_cloudtrail:0000505:af8ebcd2-60a3-45f5-b932-3f78f8653e06", "row_index": 505, "timestamp": "2019-03-26T18:10:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af8ebcd2-60a3-45f5-b932-3f78f8653e06", "eventTime": "2019-03-26T18:10:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwQWp6eU55UUlxOXBwd2E2djJDRG8xWWxmcVNXb3ptV0lMUzJMeTlNZnhwT1NwYS9ETmNhS0w4QnU0NWEyQW9sdjVzdkdpREY5VXloMVBGb3ViMXNDMXZKdE9SbzRGdGtNSW1SOFl4Q3dhTFVHMGNaeXMxWHhhRlZTeHB2Y0RoRWVRK1VDanppUXdHYnZqTkQwcjFrL1pXdDA2THhYd2liVEMyNzFwUUVGdFZCamdFK3EvQndtLzVwbmJwNzZZVTZPWlJIOGxMK0JuTW5NZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af8ebcd2-60a3-45f5-b932-3f78f8653e06", "record_id": "flaws_cloudtrail:0000506:af8ebcd2-60a3-45f5-b932-3f78f8653e06", "row_index": 506, "timestamp": "2019-03-26T18:10:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af8ebcd2-60a3-45f5-b932-3f78f8653e06", "eventTime": "2019-03-26T18:10:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwQWp6eU55UUlxOXBwd2E2djJDRG8xWWxmcVNXb3ptV0lMUzJMeTlNZnhwT1NwYS9ETmNhS0w4QnU0NWEyQW9sdjVzdkdpREY5VXloMVBGb3ViMXNDMXZKdE9SbzRGdGtNSW1SOFl4Q3dhTFVHMGNaeXMxWHhhRlZTeHB2Y0RoRWVRK1VDanppUXdHYnZqTkQwcjFrL1pXdDA2THhYd2liVEMyNzFwUUVGdFZCamdFK3EvQndtLzVwbmJwNzZZVTZPWlJIOGxMK0JuTW5NZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1c9a0a5-2fe5-4de7-bd12-3f5639f76837", "record_id": "flaws_cloudtrail:0000507:e1c9a0a5-2fe5-4de7-bd12-3f5639f76837", "row_index": 507, "timestamp": "2019-03-26T18:10:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1c9a0a5-2fe5-4de7-bd12-3f5639f76837", "eventTime": "2019-03-26T18:10:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlN240WE5BZXpCUTlSSEppNDU0OUYxVGd3M045a2dULzZqMmRWTnUzRDMrYjJsYmZkN2FKSFRnRXFWbHppc2lvZVVsdmhXL0EvcmkreWN6empJajFQUzdoaUFMK256aHFORmxlSXlJallOUWxiN2wxdDlWOWdhazVKRURkc3hFVFUrUjI0VlozRkxVQkRpWXB5RkZYRi9VYlRFQUhjTUFaeXE5OHJ2QmJpa3dueVpoMFdibWxNOGtWTDFQcFVKN25udmtXSnZQa0tRcDRpZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1c9a0a5-2fe5-4de7-bd12-3f5639f76837", "record_id": "flaws_cloudtrail:0000508:e1c9a0a5-2fe5-4de7-bd12-3f5639f76837", "row_index": 508, "timestamp": "2019-03-26T18:10:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1c9a0a5-2fe5-4de7-bd12-3f5639f76837", "eventTime": "2019-03-26T18:10:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlN240WE5BZXpCUTlSSEppNDU0OUYxVGd3M045a2dULzZqMmRWTnUzRDMrYjJsYmZkN2FKSFRnRXFWbHppc2lvZVVsdmhXL0EvcmkreWN6empJajFQUzdoaUFMK256aHFORmxlSXlJallOUWxiN2wxdDlWOWdhazVKRURkc3hFVFUrUjI0VlozRkxVQkRpWXB5RkZYRi9VYlRFQUhjTUFaeXE5OHJ2QmJpa3dueVpoMFdibWxNOGtWTDFQcFVKN25udmtXSnZQa0tRcDRpZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c9e50d2-826b-40a0-b2ea-7587bf20ba79", "record_id": "flaws_cloudtrail:0000509:4c9e50d2-826b-40a0-b2ea-7587bf20ba79", "row_index": 509, "timestamp": "2019-03-26T18:10:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c9e50d2-826b-40a0-b2ea-7587bf20ba79", "eventTime": "2019-03-26T18:10:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKRDFNNWlNZ0NncFlWemE5enVxekx4dTRQb0lyT3BiUm9Edk1oNnc2WGxvTEJ5ZzBoZlBEd1IwcTZrc0VhV2Uzdk5Ub3lYbVdPcDNrdVUrdVZCQnhYL1YyellsYWFnc2NlOWVwNVVScFF4bU52VXV1T2pINUQ1eTA3eXNycHFnN2VMZkw5R3JQSW05UkhlamwxS0ExUmNGUFR3TU5oZ21ESmxSUms2NHJsZmxRUnZUeXRrVWR2MGVXR2hOMEZibk1vaHM2ODNyVEd4OC9Qdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c9e50d2-826b-40a0-b2ea-7587bf20ba79", "record_id": "flaws_cloudtrail:0000510:4c9e50d2-826b-40a0-b2ea-7587bf20ba79", "row_index": 510, "timestamp": "2019-03-26T18:10:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c9e50d2-826b-40a0-b2ea-7587bf20ba79", "eventTime": "2019-03-26T18:10:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKRDFNNWlNZ0NncFlWemE5enVxekx4dTRQb0lyT3BiUm9Edk1oNnc2WGxvTEJ5ZzBoZlBEd1IwcTZrc0VhV2Uzdk5Ub3lYbVdPcDNrdVUrdVZCQnhYL1YyellsYWFnc2NlOWVwNVVScFF4bU52VXV1T2pINUQ1eTA3eXNycHFnN2VMZkw5R3JQSW05UkhlamwxS0ExUmNGUFR3TU5oZ21ESmxSUms2NHJsZmxRUnZUeXRrVWR2MGVXR2hOMEZibk1vaHM2ODNyVEd4OC9Qdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d03c6a23-4278-4d6a-9fdc-06c0280d720f", "record_id": "flaws_cloudtrail:0000511:d03c6a23-4278-4d6a-9fdc-06c0280d720f", "row_index": 511, "timestamp": "2019-03-26T18:10:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d03c6a23-4278-4d6a-9fdc-06c0280d720f", "eventTime": "2019-03-26T18:10:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3aHJ1TWxsMHNsOGtYcmlZNXcwNmwzTEVIOVRvQzk0VGpQdTI2azdwRHNpenhIa3RNUU9QbFJXclpZOTZSQURhNytjOStqT1hLOWg1YkVobVhGTGZSL25wTTBXMllmTFFpL256THlJSnNUUjV0Q2x3cFJWamdxQjR1QU84NU5rSVgwNzB0QzVOTjlWU0pLaUN3azNVVS9oNTRmektLSmNjZE5sSE1RYUt4ZEpZSmtkVlBsa2g3NWo2U2UrNFlxejR2MUJWV3U3WFNiUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d03c6a23-4278-4d6a-9fdc-06c0280d720f", "record_id": "flaws_cloudtrail:0000512:d03c6a23-4278-4d6a-9fdc-06c0280d720f", "row_index": 512, "timestamp": "2019-03-26T18:10:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d03c6a23-4278-4d6a-9fdc-06c0280d720f", "eventTime": "2019-03-26T18:10:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3aHJ1TWxsMHNsOGtYcmlZNXcwNmwzTEVIOVRvQzk0VGpQdTI2azdwRHNpenhIa3RNUU9QbFJXclpZOTZSQURhNytjOStqT1hLOWg1YkVobVhGTGZSL25wTTBXMllmTFFpL256THlJSnNUUjV0Q2x3cFJWamdxQjR1QU84NU5rSVgwNzB0QzVOTjlWU0pLaUN3azNVVS9oNTRmektLSmNjZE5sSE1RYUt4ZEpZSmtkVlBsa2g3NWo2U2UrNFlxejR2MUJWV3U3WFNiUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad9020bd-91ed-4105-add9-3d8488bb34f8", "record_id": "flaws_cloudtrail:0000513:ad9020bd-91ed-4105-add9-3d8488bb34f8", "row_index": 513, "timestamp": "2019-03-26T18:10:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad9020bd-91ed-4105-add9-3d8488bb34f8", "eventTime": "2019-03-26T18:10:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5VmpnTW14aVVkYTY5Z2RSTTVRZWFhQk9YMVBqVjRseUp6cTJMZERBTFljUmthdGFKK0VGYlppb0E2WmliMXFMd1RhQy9WZExXVlBIeG1DRGNmYW5rYVpJTDhySHBMTlVPQTBzRmtObnRpbi9Ua3ZZZ1F1eXNXSDFLSWxjV29WVW9LSnFWTmhIeE00VnRTRVpxOHE0UWtYUHZ1RXBzbjZWcXFUWUhkeHJLZjBlUitCUi8wR1RseFZVRVNhUWcxQ0RDMzY2d0hsYi9OTUEzZnJsZ2hGcWdzVzVKZ2pGOUowPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad9020bd-91ed-4105-add9-3d8488bb34f8", "record_id": "flaws_cloudtrail:0000514:ad9020bd-91ed-4105-add9-3d8488bb34f8", "row_index": 514, "timestamp": "2019-03-26T18:10:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad9020bd-91ed-4105-add9-3d8488bb34f8", "eventTime": "2019-03-26T18:10:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5VmpnTW14aVVkYTY5Z2RSTTVRZWFhQk9YMVBqVjRseUp6cTJMZERBTFljUmthdGFKK0VGYlppb0E2WmliMXFMd1RhQy9WZExXVlBIeG1DRGNmYW5rYVpJTDhySHBMTlVPQTBzRmtObnRpbi9Ua3ZZZ1F1eXNXSDFLSWxjV29WVW9LSnFWTmhIeE00VnRTRVpxOHE0UWtYUHZ1RXBzbjZWcXFUWUhkeHJLZjBlUitCUi8wR1RseFZVRVNhUWcxQ0RDMzY2d0hsYi9OTUEzZnJsZ2hGcWdzVzVKZ2pGOUowPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "166e951a-5109-483a-ab6c-d49fd0581ebe", "record_id": "flaws_cloudtrail:0000515:166e951a-5109-483a-ab6c-d49fd0581ebe", "row_index": 515, "timestamp": "2019-03-26T18:10:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "166e951a-5109-483a-ab6c-d49fd0581ebe", "eventTime": "2019-03-26T18:10:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRcHpHWlpoOTAwanpQWnpsOVhhbDJHVUUxai9XUElTRHJHZEpCQk5WbHY2K09RaE5kbmpOdlF3a2tDZEVzck1yOTkxWGZKSkFrcmZURU0wTVZaZlI1b0d5VHExUUozQk95Q3Z5d0h6eUQwSTFZVkIzLzc3VE9pcnlDczRyMXZoV1RYRkoyVklHeWtJVHBBZHUyTDJjSmlGZUxSTmZWVXNTRTRJRXhPWjE3Zk01cUNFMGRTelVxVEpDeVFyM2dQYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "166e951a-5109-483a-ab6c-d49fd0581ebe", "record_id": "flaws_cloudtrail:0000516:166e951a-5109-483a-ab6c-d49fd0581ebe", "row_index": 516, "timestamp": "2019-03-26T18:10:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "166e951a-5109-483a-ab6c-d49fd0581ebe", "eventTime": "2019-03-26T18:10:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRcHpHWlpoOTAwanpQWnpsOVhhbDJHVUUxai9XUElTRHJHZEpCQk5WbHY2K09RaE5kbmpOdlF3a2tDZEVzck1yOTkxWGZKSkFrcmZURU0wTVZaZlI1b0d5VHExUUozQk95Q3Z5d0h6eUQwSTFZVkIzLzc3VE9pcnlDczRyMXZoV1RYRkoyVklHeWtJVHBBZHUyTDJjSmlGZUxSTmZWVXNTRTRJRXhPWjE3Zk01cUNFMGRTelVxVEpDeVFyM2dQYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40a185ff-be5a-485d-8f24-fefd3c89e133", "record_id": "flaws_cloudtrail:0000517:40a185ff-be5a-485d-8f24-fefd3c89e133", "row_index": 517, "timestamp": "2019-03-26T18:10:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40a185ff-be5a-485d-8f24-fefd3c89e133", "eventTime": "2019-03-26T18:10:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2L0VLSVh3RThEZ3BzbnZBMWRoRFZEZjJPYi9JcUxsaVArZzhES1IvWDhJZ0dwdXYxSXNOY2NhN3cwWVE3bnZJMS9NaUpmeTNMZFVYZ2Vhc1dhYzN6Tmxhdy9SdDU1SGhJR2VDbWlIUkNXQjBKU0kyUDN2SlQ1ajBERlM0aWtlY1dEenVjMGlKQ3FyaG9HMkV0V0xoYVY3MEhxMkNEOGtEcGVTOXE5LzcrN0ZIZXpBS3g1a3ZRV2tha2lTSmZIODgrOURxcVlyN0ZCb2VXT00zTEtQZC8remluQXh3TFNvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40a185ff-be5a-485d-8f24-fefd3c89e133", "record_id": "flaws_cloudtrail:0000518:40a185ff-be5a-485d-8f24-fefd3c89e133", "row_index": 518, "timestamp": "2019-03-26T18:10:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40a185ff-be5a-485d-8f24-fefd3c89e133", "eventTime": "2019-03-26T18:10:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2L0VLSVh3RThEZ3BzbnZBMWRoRFZEZjJPYi9JcUxsaVArZzhES1IvWDhJZ0dwdXYxSXNOY2NhN3cwWVE3bnZJMS9NaUpmeTNMZFVYZ2Vhc1dhYzN6Tmxhdy9SdDU1SGhJR2VDbWlIUkNXQjBKU0kyUDN2SlQ1ajBERlM0aWtlY1dEenVjMGlKQ3FyaG9HMkV0V0xoYVY3MEhxMkNEOGtEcGVTOXE5LzcrN0ZIZXpBS3g1a3ZRV2tha2lTSmZIODgrOURxcVlyN0ZCb2VXT00zTEtQZC8remluQXh3TFNvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f16d01c1-bef9-4035-92e6-eac4d1f38baa", "record_id": "flaws_cloudtrail:0000519:f16d01c1-bef9-4035-92e6-eac4d1f38baa", "row_index": 519, "timestamp": "2019-03-26T18:10:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f16d01c1-bef9-4035-92e6-eac4d1f38baa", "eventTime": "2019-03-26T18:10:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5djdOZysybUpVRjNOMDhLcTJBLzd1blFiU1VHdk9DMlNzK2JrOEtkazZGT29OK3J6aFFIVXcyNkpRZTN3THdqakdvZGMySjdITGJmdHZJK3NlRTYwSlpIMUk4TnZnNlhsMGExbUMwaEJUUVdXbUlrdUtBbUpURm5DME9wUTBLQWNwTHZnTnhGa29uZEwwMngzaFFiMlh0ZG8yaHBCT3MzeGlMZUdjY0pSVzdGNngxbkc1dGY3eXU2UXhNWUpmND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f16d01c1-bef9-4035-92e6-eac4d1f38baa", "record_id": "flaws_cloudtrail:0000520:f16d01c1-bef9-4035-92e6-eac4d1f38baa", "row_index": 520, "timestamp": "2019-03-26T18:10:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f16d01c1-bef9-4035-92e6-eac4d1f38baa", "eventTime": "2019-03-26T18:10:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5djdOZysybUpVRjNOMDhLcTJBLzd1blFiU1VHdk9DMlNzK2JrOEtkazZGT29OK3J6aFFIVXcyNkpRZTN3THdqakdvZGMySjdITGJmdHZJK3NlRTYwSlpIMUk4TnZnNlhsMGExbUMwaEJUUVdXbUlrdUtBbUpURm5DME9wUTBLQWNwTHZnTnhGa29uZEwwMngzaFFiMlh0ZG8yaHBCT3MzeGlMZUdjY0pSVzdGNngxbkc1dGY3eXU2UXhNWUpmND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "582ac2f5-3961-42b6-8f93-d1bc907e6c29", "record_id": "flaws_cloudtrail:0000521:582ac2f5-3961-42b6-8f93-d1bc907e6c29", "row_index": 521, "timestamp": "2019-03-26T18:10:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1101, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "582ac2f5-3961-42b6-8f93-d1bc907e6c29", "eventTime": "2019-03-26T18:10:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtSGRIOTBRZ0tabHF2aHF5dkh4dWFRaWs2NWp3ald1dC8zTHBjSWZYM0JRa3dsVE5ob3c1R1NQK3dFZUdZTkE3aXpiQkVoYmNlNUhOVXZFM3JOcmNCVytmaVhpamdKSmJydXVUMlp2eE1ad1dhdGxFUFk3RGN4cnJ5SFRqUm1oMmhYbDFEYmFscUdKSzBVdXRJQnFGRERkVXp4QXVhUjc4Uk12TnlHN2JBMC9zVlhQSGdHbmJqVTc2MkFaNE5udU9vUnAyZTBtK2pZTXF2UWNjL1dOUDkwUTVuenU4eldBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "582ac2f5-3961-42b6-8f93-d1bc907e6c29", "record_id": "flaws_cloudtrail:0000522:582ac2f5-3961-42b6-8f93-d1bc907e6c29", "row_index": 522, "timestamp": "2019-03-26T18:10:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1101, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "582ac2f5-3961-42b6-8f93-d1bc907e6c29", "eventTime": "2019-03-26T18:10:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtSGRIOTBRZ0tabHF2aHF5dkh4dWFRaWs2NWp3ald1dC8zTHBjSWZYM0JRa3dsVE5ob3c1R1NQK3dFZUdZTkE3aXpiQkVoYmNlNUhOVXZFM3JOcmNCVytmaVhpamdKSmJydXVUMlp2eE1ad1dhdGxFUFk3RGN4cnJ5SFRqUm1oMmhYbDFEYmFscUdKSzBVdXRJQnFGRERkVXp4QXVhUjc4Uk12TnlHN2JBMC9zVlhQSGdHbmJqVTc2MkFaNE5udU9vUnAyZTBtK2pZTXF2UWNjL1dOUDkwUTVuenU4eldBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c47f0f83-b8a4-4dd4-bd53-0f41643c9b", "record_id": "flaws_cloudtrail:0000523:c47f0f83-b8a4-4dd4-bd53-0f41643c9b", "row_index": 523, "timestamp": "2019-03-26T18:10:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c47f0f83-b8a4-4dd4-bd53-0f41643c9b", "eventTime": "2019-03-26T18:10:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0Q3RKYTYzd25oZGpWVkQxbGRSRmdrdmNFN01aYmc2bkdJeXRkdDFTb05xa0NMVmtJSXRydXo3QkRXTW5mc3Yyc1dhRVg1enlKZitmMGx1UlhPNG54SWdmUmZtOFR0cldERmk3U0VCTjJHb1hGcEJiaHBZSDBLTUw2NGUzWVZ5SGhGeXp0UzJQNFVYaFVNK2JJYXhyY1FkeG1PTGg2STBsM3Y4T2pHMjN2elhqdUF3ZW1jamQzMDVQODdsRy9PST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c47f0f83-b8a4-4dd4-bd53-0f41643c9b", "record_id": "flaws_cloudtrail:0000524:c47f0f83-b8a4-4dd4-bd53-0f41643c9b", "row_index": 524, "timestamp": "2019-03-26T18:10:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c47f0f83-b8a4-4dd4-bd53-0f41643c9b", "eventTime": "2019-03-26T18:10:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0Q3RKYTYzd25oZGpWVkQxbGRSRmdrdmNFN01aYmc2bkdJeXRkdDFTb05xa0NMVmtJSXRydXo3QkRXTW5mc3Yyc1dhRVg1enlKZitmMGx1UlhPNG54SWdmUmZtOFR0cldERmk3U0VCTjJHb1hGcEJiaHBZSDBLTUw2NGUzWVZ5SGhGeXp0UzJQNFVYaFVNK2JJYXhyY1FkeG1PTGg2STBsM3Y4T2pHMjN2elhqdUF3ZW1jamQzMDVQODdsRy9PST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e710819bf-f868-4aa4-b115-76db8c67c5da", "record_id": "flaws_cloudtrail:0000525:e710819bf-f868-4aa4-b115-76db8c67c5da", "row_index": 525, "timestamp": "2019-03-26T18:10:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e710819bf-f868-4aa4-b115-76db8c67c5da", "eventTime": "2019-03-26T18:10:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNYmZCYk5MekdBTzZtWml0bDFLeXlSMTI0SkIxT055Vi9TUHljVGVtdU1rNThxMGl2d1hxdDJOL2RKSHFDRUhRV3BhTWxJNlRIZHJFazBCZGk3SnZzbkpia0p0WWtRdEZEcExhSStCOHlYdDRNM1lTekVJbld6dzVsc21xa3ovL1JyS3BoUzdYWUdrS0tUS1BFU2hhMEFwZ0xpV05UU1R0WG5QRDRXZEMxZmtLTHZUMWU4THNtNzdvTWFRRHVtSTJvNXU2U2hFbEtCMVpIK3pYRkFDakFEdklJZEp2SS9rPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e710819bf-f868-4aa4-b115-76db8c67c5da", "record_id": "flaws_cloudtrail:0000526:e710819bf-f868-4aa4-b115-76db8c67c5da", "row_index": 526, "timestamp": "2019-03-26T18:10:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e710819bf-f868-4aa4-b115-76db8c67c5da", "eventTime": "2019-03-26T18:10:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNYmZCYk5MekdBTzZtWml0bDFLeXlSMTI0SkIxT055Vi9TUHljVGVtdU1rNThxMGl2d1hxdDJOL2RKSHFDRUhRV3BhTWxJNlRIZHJFazBCZGk3SnZzbkpia0p0WWtRdEZEcExhSStCOHlYdDRNM1lTekVJbld6dzVsc21xa3ovL1JyS3BoUzdYWUdrS0tUS1BFU2hhMEFwZ0xpV05UU1R0WG5QRDRXZEMxZmtLTHZUMWU4THNtNzdvTWFRRHVtSTJvNXU2U2hFbEtCMVpIK3pYRkFDakFEdklJZEp2SS9rPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e13e19d3-f365-4072-b599-197166d1b594e", "record_id": "flaws_cloudtrail:0000527:e13e19d3-f365-4072-b599-197166d1b594e", "row_index": 527, "timestamp": "2019-03-26T18:10:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e13e19d3-f365-4072-b599-197166d1b594e", "eventTime": "2019-03-26T18:10:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwNWRyRE0yZ0IveThyWksrMjVxdnJMRVNkZ1EzYWhiS21Ba0VZZDdWWDlrSSsxRkU2anVXVzY3UVIyWnVEUi9zdHBaeXFUcmFjTEg2eHNNN2w0RjgxRVhFV3hxWmxySDZ1NTRDUVBBWUpSTTd1TTJ3VnN0Y1dNQjJWM2xuNzg2WTdwT2w4anFhT21UTWdmTVBmTW5KYlNoWjNFZCs3bU9pRXAvQVhMRXg1NHB3MVp5SkM0WEVZUW5YNXQrZkF1WT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e13e19d3-f365-4072-b599-197166d1b594e", "record_id": "flaws_cloudtrail:0000528:e13e19d3-f365-4072-b599-197166d1b594e", "row_index": 528, "timestamp": "2019-03-26T18:10:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e13e19d3-f365-4072-b599-197166d1b594e", "eventTime": "2019-03-26T18:10:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwNWRyRE0yZ0IveThyWksrMjVxdnJMRVNkZ1EzYWhiS21Ba0VZZDdWWDlrSSsxRkU2anVXVzY3UVIyWnVEUi9zdHBaeXFUcmFjTEg2eHNNN2w0RjgxRVhFV3hxWmxySDZ1NTRDUVBBWUpSTTd1TTJ3VnN0Y1dNQjJWM2xuNzg2WTdwT2w4anFhT21UTWdmTVBmTW5KYlNoWjNFZCs3bU9pRXAvQVhMRXg1NHB3MVp5SkM0WEVZUW5YNXQrZkF1WT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c44aeb99-cf63-4b56-a28d-a3e42f01d513", "record_id": "flaws_cloudtrail:0000529:c44aeb99-cf63-4b56-a28d-a3e42f01d513", "row_index": 529, "timestamp": "2019-03-26T18:10:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c44aeb99-cf63-4b56-a28d-a3e42f01d513", "eventTime": "2019-03-26T18:10:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQZU85dlA4TzdGc29hRE0vbzduV21MM0JYck9ZbVdwbnN5SzhZVm1jQ0QrWEdTMmUyMUQ1cG95WUt3TVVCaTUwTCt1UlZuZzBpaUthZTdFN2Y0N1lDbkpCYnZVaTJ6Z1JQYlNxTUtGSUNYcGtydm5wcUlScWhSVHBNQUVISkE2SzVGQVR2Nm03anp3ZTcwcDhKTVRIMkxsalBnQUUxTWtrZ0VieStObDlyc1Nna0Ryb2E5NXJEUnMvc25hRFZWeDhvWnJNRVdjclRNYW93SHRnZGVnNWl2dE02cmZXSlJBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c44aeb99-cf63-4b56-a28d-a3e42f01d513", "record_id": "flaws_cloudtrail:0000530:c44aeb99-cf63-4b56-a28d-a3e42f01d513", "row_index": 530, "timestamp": "2019-03-26T18:10:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1103, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c44aeb99-cf63-4b56-a28d-a3e42f01d513", "eventTime": "2019-03-26T18:10:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQZU85dlA4TzdGc29hRE0vbzduV21MM0JYck9ZbVdwbnN5SzhZVm1jQ0QrWEdTMmUyMUQ1cG95WUt3TVVCaTUwTCt1UlZuZzBpaUthZTdFN2Y0N1lDbkpCYnZVaTJ6Z1JQYlNxTUtGSUNYcGtydm5wcUlScWhSVHBNQUVISkE2SzVGQVR2Nm03anp3ZTcwcDhKTVRIMkxsalBnQUUxTWtrZ0VieStObDlyc1Nna0Ryb2E5NXJEUnMvc25hRFZWeDhvWnJNRVdjclRNYW93SHRnZGVnNWl2dE02cmZXSlJBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03cd9ef8-4f2b-4eae-a080-51acd772961", "record_id": "flaws_cloudtrail:0000531:03cd9ef8-4f2b-4eae-a080-51acd772961", "row_index": 531, "timestamp": "2019-03-26T18:10:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03cd9ef8-4f2b-4eae-a080-51acd772961", "eventTime": "2019-03-26T18:10:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFWXpmaEhucGxPYjY5VXBSZHBwek96bmpiNCtWMmxzODNTRmxNb0ZZYmVyOHU5cHk5V0ROSjRkUllnOWFFV2NoSkh1MVl1a0toUWpOem9uVytabVBlb1p0K29tcXV6VEprNGZNei8vdHozRThiL0IrVWNSNmtmeWEwODRyT1NGWnZRcnhhc1kxdEg0TGR2NExTVFAvdyttSFZrR3pGTWJ6TnVRKzRXVW1RT1ZYUXYxVGlaYXdKRHUva3BsYkU4MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03cd9ef8-4f2b-4eae-a080-51acd772961", "record_id": "flaws_cloudtrail:0000532:03cd9ef8-4f2b-4eae-a080-51acd772961", "row_index": 532, "timestamp": "2019-03-26T18:10:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03cd9ef8-4f2b-4eae-a080-51acd772961", "eventTime": "2019-03-26T18:10:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFWXpmaEhucGxPYjY5VXBSZHBwek96bmpiNCtWMmxzODNTRmxNb0ZZYmVyOHU5cHk5V0ROSjRkUllnOWFFV2NoSkh1MVl1a0toUWpOem9uVytabVBlb1p0K29tcXV6VEprNGZNei8vdHozRThiL0IrVWNSNmtmeWEwODRyT1NGWnZRcnhhc1kxdEg0TGR2NExTVFAvdyttSFZrR3pGTWJ6TnVRKzRXVW1RT1ZYUXYxVGlaYXdKRHUva3BsYkU4MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7ddbeea-c7ae-4853-b95e-8d181aaefa82", "record_id": "flaws_cloudtrail:0000533:f7ddbeea-c7ae-4853-b95e-8d181aaefa82", "row_index": 533, "timestamp": "2019-03-26T18:12:23Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1175, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7ddbeea-c7ae-4853-b95e-8d181aaefa82", "eventTime": "2019-03-26T18:12:23Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListAttachedUserPolicies on resource: role flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7ddbeea-c7ae-4853-b95e-8d181aaefa82", "record_id": "flaws_cloudtrail:0000534:f7ddbeea-c7ae-4853-b95e-8d181aaefa82", "row_index": 534, "timestamp": "2019-03-26T18:12:23Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1175, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7ddbeea-c7ae-4853-b95e-8d181aaefa82", "eventTime": "2019-03-26T18:12:23Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListAttachedUserPolicies on resource: role flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4eeff627-effd-4158-bff9-8e35e516e1f9", "record_id": "flaws_cloudtrail:0000535:4eeff627-effd-4158-bff9-8e35e516e1f9", "row_index": 535, "timestamp": "2019-03-26T18:13:26Z", "event_type": "GetUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1151, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4eeff627-effd-4158-bff9-8e35e516e1f9", "eventTime": "2019-03-26T18:13:26Z", "eventName": "GetUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUserPolicy on resource: user flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4eeff627-effd-4158-bff9-8e35e516e1f9", "record_id": "flaws_cloudtrail:0000536:4eeff627-effd-4158-bff9-8e35e516e1f9", "row_index": 536, "timestamp": "2019-03-26T18:13:26Z", "event_type": "GetUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1151, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4eeff627-effd-4158-bff9-8e35e516e1f9", "eventTime": "2019-03-26T18:13:26Z", "eventName": "GetUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUserPolicy on resource: user flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f18b338-57cf-4697-8bb2-3db6b5bb67bd", "record_id": "flaws_cloudtrail:0000537:1f18b338-57cf-4697-8bb2-3db6b5bb67bd", "row_index": 537, "timestamp": "2019-03-26T18:16:00Z", "event_type": "GetRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1151, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f18b338-57cf-4697-8bb2-3db6b5bb67bd", "eventTime": "2019-03-26T18:16:00Z", "eventName": "GetRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetRolePolicy on resource: role flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f18b338-57cf-4697-8bb2-3db6b5bb67bd", "record_id": "flaws_cloudtrail:0000538:1f18b338-57cf-4697-8bb2-3db6b5bb67bd", "row_index": 538, "timestamp": "2019-03-26T18:16:00Z", "event_type": "GetRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1151, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f18b338-57cf-4697-8bb2-3db6b5bb67bd", "eventTime": "2019-03-26T18:16:00Z", "eventName": "GetRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetRolePolicy on resource: role flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e9aad06-72de-4726-9d5f-e8bf6b690789", "record_id": "flaws_cloudtrail:0000539:2e9aad06-72de-4726-9d5f-e8bf6b690789", "row_index": 539, "timestamp": "2019-03-26T18:17:41Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1326, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e9aad06-72de-4726-9d5f-e8bf6b690789", "eventTime": "2019-03-26T18:17:41Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-2", "sourceSnapshotId": "snap-83d15d668fb2941db", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-2.amazonaws.com/?Version=2016-09-15&SourceSnapshotId=snap-83d15d668fb2941db&DestinationRegion=us-west-2&SourceRegion=us-west-2&Action=CopySnapshot&X-Amz-Date=077787T46282Z&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-SignedHeaders=host&X-Amz-Credential=AKIA01U43UX3RBRDXF4Q%2F077787%2Fus-west-2%2Fec2%2Faws4_request&X-Amz-Expires=3600&X-Amz-Signature=106748c7e4b22dd4ab658536588c75526ec31f311d8698bd3bffcf46f66d987f"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e9aad06-72de-4726-9d5f-e8bf6b690789", "record_id": "flaws_cloudtrail:0000540:2e9aad06-72de-4726-9d5f-e8bf6b690789", "row_index": 540, "timestamp": "2019-03-26T18:17:41Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.93.64.112", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1326, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e9aad06-72de-4726-9d5f-e8bf6b690789", "eventTime": "2019-03-26T18:17:41Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.93.64.112", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-83-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-2", "sourceSnapshotId": "snap-83d15d668fb2941db", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-2.amazonaws.com/?Version=2016-09-15&SourceSnapshotId=snap-83d15d668fb2941db&DestinationRegion=us-west-2&SourceRegion=us-west-2&Action=CopySnapshot&X-Amz-Date=077787T46282Z&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-SignedHeaders=host&X-Amz-Credential=AKIA01U43UX3RBRDXF4Q%2F077787%2Fus-west-2%2Fec2%2Faws4_request&X-Amz-Expires=3600&X-Amz-Signature=106748c7e4b22dd4ab658536588c75526ec31f311d8698bd3bffcf46f66d987f"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3ea418a-d5b7-40fd-8dcb-4e65442fb1eb", "record_id": "flaws_cloudtrail:0000541:f3ea418a-d5b7-40fd-8dcb-4e65442fb1eb", "row_index": 541, "timestamp": "2019-03-26T18:17:55Z", "event_type": "DescribeMyUserProfile", "event_source": "opsworks.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3ea418a-d5b7-40fd-8dcb-4e65442fb1eb", "eventTime": "2019-03-26T18:17:55Z", "eventName": "DescribeMyUserProfile", "eventSource": "opsworks.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-1", "errorCode": "AccessDeniedException", "errorMessage": "An unknown error occurred", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3ea418a-d5b7-40fd-8dcb-4e65442fb1eb", "record_id": "flaws_cloudtrail:0000542:f3ea418a-d5b7-40fd-8dcb-4e65442fb1eb", "row_index": 542, "timestamp": "2019-03-26T18:17:55Z", "event_type": "DescribeMyUserProfile", "event_source": "opsworks.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3ea418a-d5b7-40fd-8dcb-4e65442fb1eb", "eventTime": "2019-03-26T18:17:55Z", "eventName": "DescribeMyUserProfile", "eventSource": "opsworks.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-west-1", "errorCode": "AccessDeniedException", "errorMessage": "An unknown error occurred", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2cb2258-a9e3-44a0-b6fd-cd801f38329b", "record_id": "flaws_cloudtrail:0000543:e2cb2258-a9e3-44a0-b6fd-cd801f38329b", "row_index": 543, "timestamp": "2019-03-26T18:18:52Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1167, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2cb2258-a9e3-44a0-b6fd-cd801f38329b", "eventTime": "2019-03-26T18:18:52Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListRolePolicies on resource: role SecurityAudit", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2cb2258-a9e3-44a0-b6fd-cd801f38329b", "record_id": "flaws_cloudtrail:0000544:e2cb2258-a9e3-44a0-b6fd-cd801f38329b", "row_index": 544, "timestamp": "2019-03-26T18:18:52Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1167, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2cb2258-a9e3-44a0-b6fd-cd801f38329b", "eventTime": "2019-03-26T18:18:52Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListRolePolicies on resource: role SecurityAudit", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5f1e1f4-c56e-4d6e-be8e-c9acd14df576", "record_id": "flaws_cloudtrail:0000545:c5f1e1f4-c56e-4d6e-be8e-c9acd14df576", "row_index": 545, "timestamp": "2019-03-26T18:18:59Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1159, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5f1e1f4-c56e-4d6e-be8e-c9acd14df576", "eventTime": "2019-03-26T18:18:59Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListRolePolicies on resource: role flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5f1e1f4-c56e-4d6e-be8e-c9acd14df576", "record_id": "flaws_cloudtrail:0000546:c5f1e1f4-c56e-4d6e-be8e-c9acd14df576", "row_index": 546, "timestamp": "2019-03-26T18:18:59Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1159, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5f1e1f4-c56e-4d6e-be8e-c9acd14df576", "eventTime": "2019-03-26T18:18:59Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListRolePolicies on resource: role flaws", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13d71c63-cf56-48d6-b339-b96653d971c", "record_id": "flaws_cloudtrail:0000547:13d71c63-cf56-48d6-b339-b96653d971c", "row_index": 547, "timestamp": "2019-03-26T18:20:40Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1154, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13d71c63-cf56-48d6-b339-b96653d971c", "eventTime": "2019-03-26T18:20:40Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13d71c63-cf56-48d6-b339-b96653d971c", "record_id": "flaws_cloudtrail:0000548:13d71c63-cf56-48d6-b339-b96653d971c", "row_index": 548, "timestamp": "2019-03-26T18:20:40Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAWDOLHEMSNCQ0XZPW", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1154, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13d71c63-cf56-48d6-b339-b96653d971c", "eventTime": "2019-03-26T18:20:40Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAWDOLHEMSNCQ0XZPW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T17:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b1483d5-3a79-4c42-8239-ca15c9f71f3e", "record_id": "flaws_cloudtrail:0000549:7b1483d5-3a79-4c42-8239-ca15c9f71f3e", "row_index": 549, "timestamp": "2019-03-26T18:21:46Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b1483d5-3a79-4c42-8239-ca15c9f71f3e", "eventTime": "2019-03-26T18:21:46Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b1483d5-3a79-4c42-8239-ca15c9f71f3e", "record_id": "flaws_cloudtrail:0000550:7b1483d5-3a79-4c42-8239-ca15c9f71f3e", "row_index": 550, "timestamp": "2019-03-26T18:21:46Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b1483d5-3a79-4c42-8239-ca15c9f71f3e", "eventTime": "2019-03-26T18:21:46Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "883ff4d5-3bc4-4244-8724-f5567c13097", "record_id": "flaws_cloudtrail:0000551:883ff4d5-3bc4-4244-8724-f5567c13097", "row_index": 551, "timestamp": "2019-03-26T18:23:03Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "883ff4d5-3bc4-4244-8724-f5567c13097", "eventTime": "2019-03-26T18:23:03Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "883ff4d5-3bc4-4244-8724-f5567c13097", "record_id": "flaws_cloudtrail:0000552:883ff4d5-3bc4-4244-8724-f5567c13097", "row_index": 552, "timestamp": "2019-03-26T18:23:03Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "883ff4d5-3bc4-4244-8724-f5567c13097", "eventTime": "2019-03-26T18:23:03Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93a1510a-1d21-49e3-812b-fbe79c690244", "record_id": "flaws_cloudtrail:0000553:93a1510a-1d21-49e3-812b-fbe79c690244", "row_index": 553, "timestamp": "2019-03-26T18:25:11Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 669, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93a1510a-1d21-49e3-812b-fbe79c690244", "eventTime": "2019-03-26T18:25:11Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93a1510a-1d21-49e3-812b-fbe79c690244", "record_id": "flaws_cloudtrail:0000554:93a1510a-1d21-49e3-812b-fbe79c690244", "row_index": 554, "timestamp": "2019-03-26T18:25:11Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 669, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93a1510a-1d21-49e3-812b-fbe79c690244", "eventTime": "2019-03-26T18:25:11Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3d349f4-db59-4bd1-b9bf-a88b74f5829b", "record_id": "flaws_cloudtrail:0000555:d3d349f4-db59-4bd1-b9bf-a88b74f5829b", "row_index": 555, "timestamp": "2019-03-26T18:25:15Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 740, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3d349f4-db59-4bd1-b9bf-a88b74f5829b", "eventTime": "2019-03-26T18:25:15Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3d349f4-db59-4bd1-b9bf-a88b74f5829b", "record_id": "flaws_cloudtrail:0000556:d3d349f4-db59-4bd1-b9bf-a88b74f5829b", "row_index": 556, "timestamp": "2019-03-26T18:25:15Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.252.39.140", "user_agent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 740, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3d349f4-db59-4bd1-b9bf-a88b74f5829b", "eventTime": "2019-03-26T18:25:15Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.252.39.140", "userAgent": "aws-cli/1.16.130 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.120", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83a4117a-969f-4805-9c35-01da090dbbc5", "record_id": "flaws_cloudtrail:0000557:83a4117a-969f-4805-9c35-01da090dbbc5", "row_index": 557, "timestamp": "2019-03-26T18:26:09Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83a4117a-969f-4805-9c35-01da090dbbc5", "eventTime": "2019-03-26T18:26:09Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83a4117a-969f-4805-9c35-01da090dbbc5", "record_id": "flaws_cloudtrail:0000558:83a4117a-969f-4805-9c35-01da090dbbc5", "row_index": 558, "timestamp": "2019-03-26T18:26:09Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83a4117a-969f-4805-9c35-01da090dbbc5", "eventTime": "2019-03-26T18:26:09Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a477d61-0bdc-42b0-a209-364783d7", "record_id": "flaws_cloudtrail:0000559:9a477d61-0bdc-42b0-a209-364783d7", "row_index": 559, "timestamp": "2019-03-26T18:27:31Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAHQ7KJAFZEFC7JHH8", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "47.213.210.117", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1027, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a477d61-0bdc-42b0-a209-364783d7", "eventTime": "2019-03-26T18:27:31Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "47.213.210.117", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAHQ7KJAFZEFC7JHH8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T18:27:30Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/03/26/[$LATEST]6cd01ce6646bf77da901ec442c238c12", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a477d61-0bdc-42b0-a209-364783d7", "record_id": "flaws_cloudtrail:0000560:9a477d61-0bdc-42b0-a209-364783d7", "row_index": 560, "timestamp": "2019-03-26T18:27:31Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAHQ7KJAFZEFC7JHH8", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "47.213.210.117", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1027, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a477d61-0bdc-42b0-a209-364783d7", "eventTime": "2019-03-26T18:27:31Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "47.213.210.117", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAHQ7KJAFZEFC7JHH8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T18:27:30Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/03/26/[$LATEST]6cd01ce6646bf77da901ec442c238c12", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bf2eaa5-2ad4-429b-990a-ddcf741192ec", "record_id": "flaws_cloudtrail:0000561:9bf2eaa5-2ad4-429b-990a-ddcf741192ec", "row_index": 561, "timestamp": "2019-03-26T18:28:24Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 731, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bf2eaa5-2ad4-429b-990a-ddcf741192ec", "eventTime": "2019-03-26T18:28:24Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/MySecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bf2eaa5-2ad4-429b-990a-ddcf741192ec", "record_id": "flaws_cloudtrail:0000562:9bf2eaa5-2ad4-429b-990a-ddcf741192ec", "row_index": 562, "timestamp": "2019-03-26T18:28:24Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 731, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bf2eaa5-2ad4-429b-990a-ddcf741192ec", "eventTime": "2019-03-26T18:28:24Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/MySecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b38c384b-68a2-426a-83a2-09f227e813cb", "record_id": "flaws_cloudtrail:0000563:b38c384b-68a2-426a-83a2-09f227e813cb", "row_index": 563, "timestamp": "2019-03-26T18:28:51Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b38c384b-68a2-426a-83a2-09f227e813cb", "eventTime": "2019-03-26T18:28:51Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b38c384b-68a2-426a-83a2-09f227e813cb", "record_id": "flaws_cloudtrail:0000564:b38c384b-68a2-426a-83a2-09f227e813cb", "row_index": 564, "timestamp": "2019-03-26T18:28:51Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b38c384b-68a2-426a-83a2-09f227e813cb", "eventTime": "2019-03-26T18:28:51Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a448106b4-88f4-408a-9cb0-7707b3e494881", "record_id": "flaws_cloudtrail:0000565:a448106b4-88f4-408a-9cb0-7707b3e494881", "row_index": 565, "timestamp": "2019-03-26T18:31:03Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a448106b4-88f4-408a-9cb0-7707b3e494881", "eventTime": "2019-03-26T18:31:03Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a448106b4-88f4-408a-9cb0-7707b3e494881", "record_id": "flaws_cloudtrail:0000566:a448106b4-88f4-408a-9cb0-7707b3e494881", "row_index": 566, "timestamp": "2019-03-26T18:31:03Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a448106b4-88f4-408a-9cb0-7707b3e494881", "eventTime": "2019-03-26T18:31:03Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18e2f683-a40a-4cfd-90a9-823065a6f8dc", "record_id": "flaws_cloudtrail:0000567:18e2f683-a40a-4cfd-90a9-823065a6f8dc", "row_index": 567, "timestamp": "2019-03-26T18:31:49Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18e2f683-a40a-4cfd-90a9-823065a6f8dc", "eventTime": "2019-03-26T18:31:49Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/MySecurityAudit", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18e2f683-a40a-4cfd-90a9-823065a6f8dc", "record_id": "flaws_cloudtrail:0000568:18e2f683-a40a-4cfd-90a9-823065a6f8dc", "row_index": 568, "timestamp": "2019-03-26T18:31:49Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18e2f683-a40a-4cfd-90a9-823065a6f8dc", "eventTime": "2019-03-26T18:31:49Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/MySecurityAudit", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f5ad59f-b5c0-423b-bbca-b0b1f2fab99b", "record_id": "flaws_cloudtrail:0000569:7f5ad59f-b5c0-423b-bbca-b0b1f2fab99b", "row_index": 569, "timestamp": "2019-03-26T18:34:06Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f5ad59f-b5c0-423b-bbca-b0b1f2fab99b", "eventTime": "2019-03-26T18:34:06Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f5ad59f-b5c0-423b-bbca-b0b1f2fab99b", "record_id": "flaws_cloudtrail:0000570:7f5ad59f-b5c0-423b-bbca-b0b1f2fab99b", "row_index": 570, "timestamp": "2019-03-26T18:34:06Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.251.4.6", "user_agent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f5ad59f-b5c0-423b-bbca-b0b1f2fab99b", "eventTime": "2019-03-26T18:34:06Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.251.4.6", "userAgent": "aws-cli/1.16.123 Python/3.6.8 Linux/4.19.0-kali1-amd64 botocore/1.12.113", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb898f9e-0ee1-44cd-966d-30d930c2443e", "record_id": "flaws_cloudtrail:0000571:cb898f9e-0ee1-44cd-966d-30d930c2443e", "row_index": 571, "timestamp": "2019-03-26T18:42:51Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1152, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb898f9e-0ee1-44cd-966d-30d930c2443e", "eventTime": "2019-03-26T18:42:51Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-east-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb898f9e-0ee1-44cd-966d-30d930c2443e", "record_id": "flaws_cloudtrail:0000572:cb898f9e-0ee1-44cd-966d-30d930c2443e", "row_index": 572, "timestamp": "2019-03-26T18:42:51Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1152, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb898f9e-0ee1-44cd-966d-30d930c2443e", "eventTime": "2019-03-26T18:42:51Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-east-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b4d63e5-eb1e-4fe6-89ed-b6ce56db6deb", "record_id": "flaws_cloudtrail:0000573:0b4d63e5-eb1e-4fe6-89ed-b6ce56db6deb", "row_index": 573, "timestamp": "2019-03-26T18:50:47Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b4d63e5-eb1e-4fe6-89ed-b6ce56db6deb", "eventTime": "2019-03-26T18:50:47Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b4d63e5-eb1e-4fe6-89ed-b6ce56db6deb", "record_id": "flaws_cloudtrail:0000574:0b4d63e5-eb1e-4fe6-89ed-b6ce56db6deb", "row_index": 574, "timestamp": "2019-03-26T18:50:47Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b4d63e5-eb1e-4fe6-89ed-b6ce56db6deb", "eventTime": "2019-03-26T18:50:47Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d07d321d-db50-493e-bdd6-5e3d98b3c7b9", "record_id": "flaws_cloudtrail:0000575:d07d321d-db50-493e-bdd6-5e3d98b3c7b9", "row_index": 575, "timestamp": "2019-03-26T18:50:49Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d07d321d-db50-493e-bdd6-5e3d98b3c7b9", "eventTime": "2019-03-26T18:50:49Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d07d321d-db50-493e-bdd6-5e3d98b3c7b9", "record_id": "flaws_cloudtrail:0000576:d07d321d-db50-493e-bdd6-5e3d98b3c7b9", "row_index": 576, "timestamp": "2019-03-26T18:50:49Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d07d321d-db50-493e-bdd6-5e3d98b3c7b9", "eventTime": "2019-03-26T18:50:49Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68eb4480-a791-4709-80df-4d7675f16a17", "record_id": "flaws_cloudtrail:0000577:68eb4480-a791-4709-80df-4d7675f16a17", "row_index": 577, "timestamp": "2019-03-26T18:50:57Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68eb4480-a791-4709-80df-4d7675f16a17", "eventTime": "2019-03-26T18:50:57Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68eb4480-a791-4709-80df-4d7675f16a17", "record_id": "flaws_cloudtrail:0000578:68eb4480-a791-4709-80df-4d7675f16a17", "row_index": 578, "timestamp": "2019-03-26T18:50:57Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68eb4480-a791-4709-80df-4d7675f16a17", "eventTime": "2019-03-26T18:50:57Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78ec7e90-34dd-422d-9448-8e7eaeddb291", "record_id": "flaws_cloudtrail:0000579:78ec7e90-34dd-422d-9448-8e7eaeddb291", "row_index": 579, "timestamp": "2019-03-26T18:50:58Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78ec7e90-34dd-422d-9448-8e7eaeddb291", "eventTime": "2019-03-26T18:50:58Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78ec7e90-34dd-422d-9448-8e7eaeddb291", "record_id": "flaws_cloudtrail:0000580:78ec7e90-34dd-422d-9448-8e7eaeddb291", "row_index": 580, "timestamp": "2019-03-26T18:50:58Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78ec7e90-34dd-422d-9448-8e7eaeddb291", "eventTime": "2019-03-26T18:50:58Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6ed8b95-c2b9-4989-88aa-e25b7350a8d2", "record_id": "flaws_cloudtrail:0000581:c6ed8b95-c2b9-4989-88aa-e25b7350a8d2", "row_index": 581, "timestamp": "2019-03-26T18:51:05Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1032, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6ed8b95-c2b9-4989-88aa-e25b7350a8d2", "eventTime": "2019-03-26T18:51:05Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6ed8b95-c2b9-4989-88aa-e25b7350a8d2", "record_id": "flaws_cloudtrail:0000582:c6ed8b95-c2b9-4989-88aa-e25b7350a8d2", "row_index": 582, "timestamp": "2019-03-26T18:51:05Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1032, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6ed8b95-c2b9-4989-88aa-e25b7350a8d2", "eventTime": "2019-03-26T18:51:05Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b75e8e0-80dd-4f1b-9880-720ac9eb7b26", "record_id": "flaws_cloudtrail:0000583:8b75e8e0-80dd-4f1b-9880-720ac9eb7b26", "row_index": 583, "timestamp": "2019-03-26T18:51:10Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b75e8e0-80dd-4f1b-9880-720ac9eb7b26", "eventTime": "2019-03-26T18:51:10Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b75e8e0-80dd-4f1b-9880-720ac9eb7b26", "record_id": "flaws_cloudtrail:0000584:8b75e8e0-80dd-4f1b-9880-720ac9eb7b26", "row_index": 584, "timestamp": "2019-03-26T18:51:10Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b75e8e0-80dd-4f1b-9880-720ac9eb7b26", "eventTime": "2019-03-26T18:51:10Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89824cd-7612-4582-b610-abfb9f69ad8f", "record_id": "flaws_cloudtrail:0000585:89824cd-7612-4582-b610-abfb9f69ad8f", "row_index": 585, "timestamp": "2019-03-26T18:51:12Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89824cd-7612-4582-b610-abfb9f69ad8f", "eventTime": "2019-03-26T18:51:12Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89824cd-7612-4582-b610-abfb9f69ad8f", "record_id": "flaws_cloudtrail:0000586:89824cd-7612-4582-b610-abfb9f69ad8f", "row_index": 586, "timestamp": "2019-03-26T18:51:12Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89824cd-7612-4582-b610-abfb9f69ad8f", "eventTime": "2019-03-26T18:51:12Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cd00efb-84e9-4a2f-9f17-19169e4f2310", "record_id": "flaws_cloudtrail:0000587:8cd00efb-84e9-4a2f-9f17-19169e4f2310", "row_index": 587, "timestamp": "2019-03-26T18:51:25Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1141, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cd00efb-84e9-4a2f-9f17-19169e4f2310", "eventTime": "2019-03-26T18:51:25Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cd00efb-84e9-4a2f-9f17-19169e4f2310", "record_id": "flaws_cloudtrail:0000588:8cd00efb-84e9-4a2f-9f17-19169e4f2310", "row_index": 588, "timestamp": "2019-03-26T18:51:25Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1141, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cd00efb-84e9-4a2f-9f17-19169e4f2310", "eventTime": "2019-03-26T18:51:25Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17c103298-0f0e-43e5-96da-94eefd7179cc", "record_id": "flaws_cloudtrail:0000589:17c103298-0f0e-43e5-96da-94eefd7179cc", "row_index": 589, "timestamp": "2019-03-26T18:51:26Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1167, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17c103298-0f0e-43e5-96da-94eefd7179cc", "eventTime": "2019-03-26T18:51:26Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17c103298-0f0e-43e5-96da-94eefd7179cc", "record_id": "flaws_cloudtrail:0000590:17c103298-0f0e-43e5-96da-94eefd7179cc", "row_index": 590, "timestamp": "2019-03-26T18:51:26Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1167, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17c103298-0f0e-43e5-96da-94eefd7179cc", "eventTime": "2019-03-26T18:51:26Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eec5517a-64b2-413a-91cb-4ecc3509aeea", "record_id": "flaws_cloudtrail:0000591:eec5517a-64b2-413a-91cb-4ecc3509aeea", "row_index": 591, "timestamp": "2019-03-26T18:52:35Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1151, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eec5517a-64b2-413a-91cb-4ecc3509aeea", "eventTime": "2019-03-26T18:52:35Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-east-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eec5517a-64b2-413a-91cb-4ecc3509aeea", "record_id": "flaws_cloudtrail:0000592:eec5517a-64b2-413a-91cb-4ecc3509aeea", "row_index": 592, "timestamp": "2019-03-26T18:52:35Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1151, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eec5517a-64b2-413a-91cb-4ecc3509aeea", "eventTime": "2019-03-26T18:52:35Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "[aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1]", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.us-east-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d26288-d011-4012-a83b-d910bf71ccdf", "record_id": "flaws_cloudtrail:0000593:d26288-d011-4012-a83b-d910bf71ccdf", "row_index": 593, "timestamp": "2019-03-26T18:52:54Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1137, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d26288-d011-4012-a83b-d910bf71ccdf", "eventTime": "2019-03-26T18:52:54Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d26288-d011-4012-a83b-d910bf71ccdf", "record_id": "flaws_cloudtrail:0000594:d26288-d011-4012-a83b-d910bf71ccdf", "row_index": 594, "timestamp": "2019-03-26T18:52:54Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1137, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d26288-d011-4012-a83b-d910bf71ccdf", "eventTime": "2019-03-26T18:52:54Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b83d2ea-0557-4fa4-86b9-e37fdbeb2d92", "record_id": "flaws_cloudtrail:0000595:2b83d2ea-0557-4fa4-86b9-e37fdbeb2d92", "row_index": 595, "timestamp": "2019-03-26T18:52:56Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b83d2ea-0557-4fa4-86b9-e37fdbeb2d92", "eventTime": "2019-03-26T18:52:56Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b83d2ea-0557-4fa4-86b9-e37fdbeb2d92", "record_id": "flaws_cloudtrail:0000596:2b83d2ea-0557-4fa4-86b9-e37fdbeb2d92", "row_index": 596, "timestamp": "2019-03-26T18:52:56Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b83d2ea-0557-4fa4-86b9-e37fdbeb2d92", "eventTime": "2019-03-26T18:52:56Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c28940-3522-4d10-8015-37a62c3f4f00", "record_id": "flaws_cloudtrail:0000597:c28940-3522-4d10-8015-37a62c3f4f00", "row_index": 597, "timestamp": "2019-03-26T18:53:35Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1138, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c28940-3522-4d10-8015-37a62c3f4f00", "eventTime": "2019-03-26T18:53:35Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c28940-3522-4d10-8015-37a62c3f4f00", "record_id": "flaws_cloudtrail:0000598:c28940-3522-4d10-8015-37a62c3f4f00", "row_index": 598, "timestamp": "2019-03-26T18:53:35Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1138, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c28940-3522-4d10-8015-37a62c3f4f00", "eventTime": "2019-03-26T18:53:35Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bf3da90-15bd-4032-96c3-75559f5dc05", "record_id": "flaws_cloudtrail:0000599:8bf3da90-15bd-4032-96c3-75559f5dc05", "row_index": 599, "timestamp": "2019-03-26T18:53:36Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1165, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bf3da90-15bd-4032-96c3-75559f5dc05", "eventTime": "2019-03-26T18:53:36Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bf3da90-15bd-4032-96c3-75559f5dc05", "record_id": "flaws_cloudtrail:0000600:8bf3da90-15bd-4032-96c3-75559f5dc05", "row_index": 600, "timestamp": "2019-03-26T18:53:36Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1165, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bf3da90-15bd-4032-96c3-75559f5dc05", "eventTime": "2019-03-26T18:53:36Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8ee65ab-2186-474c-b9cc-69818d098761", "record_id": "flaws_cloudtrail:0000601:b8ee65ab-2186-474c-b9cc-69818d098761", "row_index": 601, "timestamp": "2019-03-26T18:54:34Z", "event_type": "GetSessionToken", "event_source": "sts.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8ee65ab-2186-474c-b9cc-69818d098761", "eventTime": "2019-03-26T18:54:34Z", "eventName": "GetSessionToken", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1", "awsRegion": "us-east-1", "errorCode": "AccessDeniedException", "errorMessage": "An unknown error occurred", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8ee65ab-2186-474c-b9cc-69818d098761", "record_id": "flaws_cloudtrail:0000602:b8ee65ab-2186-474c-b9cc-69818d098761", "row_index": 602, "timestamp": "2019-03-26T18:54:34Z", "event_type": "GetSessionToken", "event_source": "sts.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8ee65ab-2186-474c-b9cc-69818d098761", "eventTime": "2019-03-26T18:54:34Z", "eventName": "GetSessionToken", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "aws-cli/1.9.1 Python/2.7.10 Darwin/17.5.0 botocore/1.3.1", "awsRegion": "us-east-1", "errorCode": "AccessDeniedException", "errorMessage": "An unknown error occurred", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cda7e403-89e4-4a2d-b1e7-39e4167dbe25", "record_id": "flaws_cloudtrail:0000603:cda7e403-89e4-4a2d-b1e7-39e4167dbe25", "row_index": 603, "timestamp": "2019-03-26T19:09:14Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1140, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cda7e403-89e4-4a2d-b1e7-39e4167dbe25", "eventTime": "2019-03-26T19:09:14Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cda7e403-89e4-4a2d-b1e7-39e4167dbe25", "record_id": "flaws_cloudtrail:0000604:cda7e403-89e4-4a2d-b1e7-39e4167dbe25", "row_index": 604, "timestamp": "2019-03-26T19:09:14Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1140, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cda7e403-89e4-4a2d-b1e7-39e4167dbe25", "eventTime": "2019-03-26T19:09:14Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cc9e3da-ddc8-408b-abb2-2205ad0ec4ec", "record_id": "flaws_cloudtrail:0000605:5cc9e3da-ddc8-408b-abb2-2205ad0ec4ec", "row_index": 605, "timestamp": "2019-03-26T19:09:18Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cc9e3da-ddc8-408b-abb2-2205ad0ec4ec", "eventTime": "2019-03-26T19:09:18Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cc9e3da-ddc8-408b-abb2-2205ad0ec4ec", "record_id": "flaws_cloudtrail:0000606:5cc9e3da-ddc8-408b-abb2-2205ad0ec4ec", "row_index": 606, "timestamp": "2019-03-26T19:09:18Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cc9e3da-ddc8-408b-abb2-2205ad0ec4ec", "eventTime": "2019-03-26T19:09:18Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ecc3398-2ff5-46c1-8a4d-229d6bffb1ab", "record_id": "flaws_cloudtrail:0000607:0ecc3398-2ff5-46c1-8a4d-229d6bffb1ab", "row_index": 607, "timestamp": "2019-03-26T19:09:30Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1177, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ecc3398-2ff5-46c1-8a4d-229d6bffb1ab", "eventTime": "2019-03-26T19:09:30Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListUsers on resource: arn:aws:iam::811596193553:user/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ecc3398-2ff5-46c1-8a4d-229d6bffb1ab", "record_id": "flaws_cloudtrail:0000608:0ecc3398-2ff5-46c1-8a4d-229d6bffb1ab", "row_index": 608, "timestamp": "2019-03-26T19:09:30Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1177, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ecc3398-2ff5-46c1-8a4d-229d6bffb1ab", "eventTime": "2019-03-26T19:09:30Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListUsers on resource: arn:aws:iam::811596193553:user/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0af7d3ea-906f-4c9c-a475-c231ef08a2b3", "record_id": "flaws_cloudtrail:0000609:0af7d3ea-906f-4c9c-a475-c231ef08a2b3", "row_index": 609, "timestamp": "2019-03-26T19:09:31Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1155, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0af7d3ea-906f-4c9c-a475-c231ef08a2b3", "eventTime": "2019-03-26T19:09:31Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListMFADevices on resource: *", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb0b6f65-1de6-4caf-9bd4-97032e621246", "record_id": "flaws_cloudtrail:0000610:fb0b6f65-1de6-4caf-9bd4-97032e621246", "row_index": 610, "timestamp": "2019-03-26T19:09:31Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1179, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb0b6f65-1de6-4caf-9bd4-97032e621246", "eventTime": "2019-03-26T19:09:31Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListGroups on resource: arn:aws:iam::811596193553:group/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99edd424-deec-4004-86da-651b87757368", "record_id": "flaws_cloudtrail:0000611:99edd424-deec-4004-86da-651b87757368", "row_index": 611, "timestamp": "2019-03-26T19:09:31Z", "event_type": "ListVirtualMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAZYDW3H1K20JXIHME", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "4.225.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1199, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99edd424-deec-4004-86da-651b87757368", "eventTime": "2019-03-26T19:09:31Z", "eventName": "ListVirtualMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "4.225.0.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:13.0) Gecko/207396 ElasticWolf/5.1.7", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:ListVirtualMFADevices on resource: arn:aws:iam::811596193553:mfa/", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAZYDW3H1K20JXIHME", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-03-26T16:25:01Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}