Task: attack_reconstruction (flaws_cloudtrail)
Prompt: An IAM actor appears to validate their access, survey IAM identities and credentials, and then establish a new credentialed identity with permissions. Identify the responsible principal, the applicable MITRE ATT&CK technique, the supporting CloudTrail record_ids for each phase of the chain, and the impacted AWS assets they touched or created. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e267af28-c880-4e8a-8360-31f4f023f9e9", "record_id": "flaws_cloudtrail:0000000:e267af28-c880-4e8a-8360-31f4f023f9e9", "row_index": 0, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e267af28-c880-4e8a-8360-31f4f023f9e9", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "336745d65-383b-4fea-9035-6a12358fe2d", "record_id": "flaws_cloudtrail:0000001:336745d65-383b-4fea-9035-6a12358fe2d", "row_index": 1, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "336745d65-383b-4fea-9035-6a12358fe2d", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71099f-883d-4e66-b960-f4a80f90b7cb", "record_id": "flaws_cloudtrail:0000002:71099f-883d-4e66-b960-f4a80f90b7cb", "row_index": 2, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeRouteTables", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71099f-883d-4e66-b960-f4a80f90b7cb", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeRouteTables", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"routeTableIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be457d0c-24b1-471d-821c-fbce46b52c4d", "record_id": "flaws_cloudtrail:0000003:be457d0c-24b1-471d-821c-fbce46b52c4d", "row_index": 3, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be457d0c-24b1-471d-821c-fbce46b52c4d", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35bcad51-871c-4ccd-a43c-321270a6e1ae", "record_id": "flaws_cloudtrail:0000004:35bcad51-871c-4ccd-a43c-321270a6e1ae", "row_index": 4, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35bcad51-871c-4ccd-a43c-321270a6e1ae", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3e238562-c1c6-487a-a498-b1dafbfdc936", "record_id": "flaws_cloudtrail:0000005:a3e238562-c1c6-487a-a498-b1dafbfdc936", "row_index": 5, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeRouteTables", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3e238562-c1c6-487a-a498-b1dafbfdc936", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeRouteTables", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"routeTableIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c3dcba2d-9e0c-4199-b195-f680a83be4e1", "record_id": "flaws_cloudtrail:0000006:c3dcba2d-9e0c-4199-b195-f680a83be4e1", "row_index": 6, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeVpnGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c3dcba2d-9e0c-4199-b195-f680a83be4e1", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeVpnGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4648a608-f6c8-435b-b29b-94d05f95b520", "record_id": "flaws_cloudtrail:0000007:4648a608-f6c8-435b-b29b-94d05f95b520", "row_index": 7, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4648a608-f6c8-435b-b29b-94d05f95b520", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df915d22-beaf-4581-ae8d-2fddf85e9e73", "record_id": "flaws_cloudtrail:0000008:df915d22-beaf-4581-ae8d-2fddf85e9e73", "row_index": 8, "timestamp": "2018-10-12T15:08:39Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df915d22-beaf-4581-ae8d-2fddf85e9e73", "eventTime": "2018-10-12T15:08:39Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69fa6dc2-dd5f-4865-8e8b-8dbda79fc83e", "record_id": "flaws_cloudtrail:0000009:69fa6dc2-dd5f-4865-8e8b-8dbda79fc83e", "row_index": 9, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIA8BVRLQ05KGNSTWOY", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69fa6dc2-dd5f-4865-8e8b-8dbda79fc83e", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIA8BVRLQ05KGNSTWOY", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:38Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25a0b8b5-abe3-4231-86b2-33a3ce5dca56", "record_id": "flaws_cloudtrail:0000010:25a0b8b5-abe3-4231-86b2-33a3ce5dca56", "row_index": 10, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25a0b8b5-abe3-4231-86b2-33a3ce5dca56", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7bcb9737-b0ae-4f45-a19b-79621103b874", "record_id": "flaws_cloudtrail:0000011:7bcb9737-b0ae-4f45-a19b-79621103b874", "row_index": 11, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7bcb9737-b0ae-4f45-a19b-79621103b874", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2c18fe3-d01a-4858-8d16-3ff28f575f3e", "record_id": "flaws_cloudtrail:0000012:b2c18fe3-d01a-4858-8d16-3ff28f575f3e", "row_index": 12, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIAFJ8N7GKCZIVGUOI4", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2c18fe3-d01a-4858-8d16-3ff28f575f3e", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIAFJ8N7GKCZIVGUOI4", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:40Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ba5796b-afc3-4ecb-9e52-8c4af352af89", "record_id": "flaws_cloudtrail:0000013:1ba5796b-afc3-4ecb-9e52-8c4af352af89", "row_index": 13, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ba5796b-afc3-4ecb-9e52-8c4af352af89", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5dd6e966-d757-4e59-acb6-68955d8b72d4", "record_id": "flaws_cloudtrail:0000014:5dd6e966-d757-4e59-acb6-68955d8b72d4", "row_index": 14, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5dd6e966-d757-4e59-acb6-68955d8b72d4", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14c59d96-45d8-4aeb-beed-5a591e6a7029", "record_id": "flaws_cloudtrail:0000015:14c59d96-45d8-4aeb-beed-5a591e6a7029", "row_index": 15, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIA3ZFE5D0XDL30GWXW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14c59d96-45d8-4aeb-beed-5a591e6a7029", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIA3ZFE5D0XDL30GWXW", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:38Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6dcf860b-bfde-4ea9-9608-bb2fa704b7fe", "record_id": "flaws_cloudtrail:0000016:6dcf860b-bfde-4ea9-9608-bb2fa704b7fe", "row_index": 16, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6dcf860b-bfde-4ea9-9608-bb2fa704b7fe", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e55094-fbda-493c-8e74-69b4a669bf77", "record_id": "flaws_cloudtrail:0000017:e55094-fbda-493c-8e74-69b4a669bf77", "row_index": 17, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e55094-fbda-493c-8e74-69b4a669bf77", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47a1302c-b791-487f-af0d-990a3b1c78a0", "record_id": "flaws_cloudtrail:0000018:47a1302c-b791-487f-af0d-990a3b1c78a0", "row_index": 18, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47a1302c-b791-487f-af0d-990a3b1c78a0", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbb09017-2056-4267-963e-1b2e1b9e99b5", "record_id": "flaws_cloudtrail:0000019:fbb09017-2056-4267-963e-1b2e1b9e99b5", "row_index": 19, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbb09017-2056-4267-963e-1b2e1b9e99b5", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41d77cc7-595b-4cbf-87a6-4b9f0535e746", "record_id": "flaws_cloudtrail:0000020:41d77cc7-595b-4cbf-87a6-4b9f0535e746", "row_index": 20, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41d77cc7-595b-4cbf-87a6-4b9f0535e746", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c9d92ca-7dff-4fdc-a431-f0b0ee2cbcad", "record_id": "flaws_cloudtrail:0000021:8c9d92ca-7dff-4fdc-a431-f0b0ee2cbcad", "row_index": 21, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c9d92ca-7dff-4fdc-a431-f0b0ee2cbcad", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f860b8ca-61e4-4587-b559-e7dc1ba4334d", "record_id": "flaws_cloudtrail:0000022:f860b8ca-61e4-4587-b559-e7dc1ba4334d", "row_index": 22, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f860b8ca-61e4-4587-b559-e7dc1ba4334d", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c321dbe-9a29-4e66-8b72-db47479b1cdc", "record_id": "flaws_cloudtrail:0000023:4c321dbe-9a29-4e66-8b72-db47479b1cdc", "row_index": 23, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c321dbe-9a29-4e66-8b72-db47479b1cdc", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8d3e4a3-d392-4c98-a9ad-0a6aece90757", "record_id": "flaws_cloudtrail:0000024:f8d3e4a3-d392-4c98-a9ad-0a6aece90757", "row_index": 24, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8d3e4a3-d392-4c98-a9ad-0a6aece90757", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1bda229b-f7e0-487d-9e72-be5c5a8ef185", "record_id": "flaws_cloudtrail:0000025:1bda229b-f7e0-487d-9e72-be5c5a8ef185", "row_index": 25, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1bda229b-f7e0-487d-9e72-be5c5a8ef185", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a27efe84-4892-48d2-bf7e-e2601c5baa07", "record_id": "flaws_cloudtrail:0000026:a27efe84-4892-48d2-bf7e-e2601c5baa07", "row_index": 26, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a27efe84-4892-48d2-bf7e-e2601c5baa07", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "460ab549-2a3b-4241-bf1b-68cec278ee23", "record_id": "flaws_cloudtrail:0000027:460ab549-2a3b-4241-bf1b-68cec278ee23", "row_index": 27, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIA0X9CVZAO3GSV1FHG", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "460ab549-2a3b-4241-bf1b-68cec278ee23", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIA0X9CVZAO3GSV1FHG", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:39Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "646d1f6f-e691-45ad-aa0c-42727c6a6419", "record_id": "flaws_cloudtrail:0000028:646d1f6f-e691-45ad-aa0c-42727c6a6419", "row_index": 28, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "646d1f6f-e691-45ad-aa0c-42727c6a6419", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "663ceb3d-e0bb-4ed7-98b5-d8b86e8701ac", "record_id": "flaws_cloudtrail:0000029:663ceb3d-e0bb-4ed7-98b5-d8b86e8701ac", "row_index": 29, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "663ceb3d-e0bb-4ed7-98b5-d8b86e8701ac", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75739b5-3ce0-4e85-970b-6a2c924562ef", "record_id": "flaws_cloudtrail:0000030:75739b5-3ce0-4e85-970b-6a2c924562ef", "row_index": 30, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75739b5-3ce0-4e85-970b-6a2c924562ef", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81fe0d1e-cec5-443a-bda2-184be52b71cf", "record_id": "flaws_cloudtrail:0000031:81fe0d1e-cec5-443a-bda2-184be52b71cf", "row_index": 31, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 731, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81fe0d1e-cec5-443a-bda2-184be52b71cf", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "84f2f34d-2846-46fa-a239-113520adc9b", "record_id": "flaws_cloudtrail:0000032:84f2f34d-2846-46fa-a239-113520adc9b", "row_index": 32, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIA32JXHSW7COPC13AI", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "84f2f34d-2846-46fa-a239-113520adc9b", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIA32JXHSW7COPC13AI", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:40Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "046ec734-9508-44f4-8c34-8d40a32944e", "record_id": "flaws_cloudtrail:0000033:046ec734-9508-44f4-8c34-8d40a32944e", "row_index": 33, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeRouteTables", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "046ec734-9508-44f4-8c34-8d40a32944e", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeRouteTables", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"routeTableIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e7aad43-ba94-4113-a392-f30eb2c9be63", "record_id": "flaws_cloudtrail:0000034:6e7aad43-ba94-4113-a392-f30eb2c9be63", "row_index": 34, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e7aad43-ba94-4113-a392-f30eb2c9be63", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0c39205-7731-4ff0-8bde-88d0409a4c2c", "record_id": "flaws_cloudtrail:0000035:a0c39205-7731-4ff0-8bde-88d0409a4c2c", "row_index": 35, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0c39205-7731-4ff0-8bde-88d0409a4c2c", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27ebd320-0f86-4f8e-98c8-26c4948bf1c2", "record_id": "flaws_cloudtrail:0000036:27ebd320-0f86-4f8e-98c8-26c4948bf1c2", "row_index": 36, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27ebd320-0f86-4f8e-98c8-26c4948bf1c2", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13740b84-000a-4244-875e-e009f355a733", "record_id": "flaws_cloudtrail:0000037:13740b84-000a-4244-875e-e009f355a733", "row_index": 37, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeRouteTables", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13740b84-000a-4244-875e-e009f355a733", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeRouteTables", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"routeTableIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16dea429-2c62-4199-9075-b24dce88a6a1", "record_id": "flaws_cloudtrail:0000038:16dea429-2c62-4199-9075-b24dce88a6a1", "row_index": 38, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeVpnGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16dea429-2c62-4199-9075-b24dce88a6a1", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeVpnGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80e9d84d-4d32-4218-ac76-7e3f37bd1d4e", "record_id": "flaws_cloudtrail:0000039:80e9d84d-4d32-4218-ac76-7e3f37bd1d4e", "row_index": 39, "timestamp": "2018-10-12T15:08:40Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80e9d84d-4d32-4218-ac76-7e3f37bd1d4e", "eventTime": "2018-10-12T15:08:40Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e981fafe-481b-481a-978b-5ac57e278c69", "record_id": "flaws_cloudtrail:0000040:e981fafe-481b-481a-978b-5ac57e278c69", "row_index": 40, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e981fafe-481b-481a-978b-5ac57e278c69", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8bef525-fbcc-4d3e-b5bf-2cf483a9a03c", "record_id": "flaws_cloudtrail:0000041:a8bef525-fbcc-4d3e-b5bf-2cf483a9a03c", "row_index": 41, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8bef525-fbcc-4d3e-b5bf-2cf483a9a03c", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de4902e8-6d35-4427-8093-2271e83faaeb", "record_id": "flaws_cloudtrail:0000042:de4902e8-6d35-4427-8093-2271e83faaeb", "row_index": 42, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIAVCRHTHX2ZQG2VK1C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de4902e8-6d35-4427-8093-2271e83faaeb", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIAVCRHTHX2ZQG2VK1C", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:38Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2755bf12-7653-4ae3-bc63-e0c6fdb863252", "record_id": "flaws_cloudtrail:0000043:2755bf12-7653-4ae3-bc63-e0c6fdb863252", "row_index": 43, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 738, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2755bf12-7653-4ae3-bc63-e0c6fdb863252", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e7827a4-9f03-406a-b1e2-abf6ccf2e1d8", "record_id": "flaws_cloudtrail:0000044:3e7827a4-9f03-406a-b1e2-abf6ccf2e1d8", "row_index": 44, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIAC2D66X7X49EMLV69", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e7827a4-9f03-406a-b1e2-abf6ccf2e1d8", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIAC2D66X7X49EMLV69", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:39Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4ddca1d-e1e4-4c12-ba1b-9d750cc09f3c", "record_id": "flaws_cloudtrail:0000045:e4ddca1d-e1e4-4c12-ba1b-9d750cc09f3c", "row_index": 45, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4ddca1d-e1e4-4c12-ba1b-9d750cc09f3c", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96b60d37-6793-4983-9a4c-8d4284e3f20a", "record_id": "flaws_cloudtrail:0000046:96b60d37-6793-4983-9a4c-8d4284e3f20a", "row_index": 46, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96b60d37-6793-4983-9a4c-8d4284e3f20a", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4f54d3e-8188-473b-9984-5f11f742f553", "record_id": "flaws_cloudtrail:0000047:a4f54d3e-8188-473b-9984-5f11f742f553", "row_index": 47, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIA2LC7B0Y38AEKV33C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4f54d3e-8188-473b-9984-5f11f742f553", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIA2LC7B0Y38AEKV33C", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:39Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c8b5259-18b2-4cf4-a293-207f9173ed72", "record_id": "flaws_cloudtrail:0000048:5c8b5259-18b2-4cf4-a293-207f9173ed72", "row_index": 48, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c8b5259-18b2-4cf4-a293-207f9173ed72", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bf0f189-4249-4498-926c-4ad649287638", "record_id": "flaws_cloudtrail:0000049:9bf0f189-4249-4498-926c-4ad649287638", "row_index": 49, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bf0f189-4249-4498-926c-4ad649287638", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e6468ca-cf57-4900-ad69-6192a47b85a1", "record_id": "flaws_cloudtrail:0000050:1e6468ca-cf57-4900-ad69-6192a47b85a1", "row_index": 50, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e6468ca-cf57-4900-ad69-6192a47b85a1", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05c5bc46-39ca-4869-90e3-02eeb792b262", "record_id": "flaws_cloudtrail:0000051:05c5bc46-39ca-4869-90e3-02eeb792b262", "row_index": 51, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "ASIALPCW4JQRJSWQS2F3", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05c5bc46-39ca-4869-90e3-02eeb792b262", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "ASIALPCW4JQRJSWQS2F3", "userName": "Level6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-12T15:08:40Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "091295bde-4951-4eba-94ec-478c983b7ea4", "record_id": "flaws_cloudtrail:0000052:091295bde-4951-4eba-94ec-478c983b7ea4", "row_index": 52, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpnConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "091295bde-4951-4eba-94ec-478c983b7ea4", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpnConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpnConnectionSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d8b2e29-512c-406a-a89c-18e7d1144553", "record_id": "flaws_cloudtrail:0000053:9d8b2e29-512c-406a-a89c-18e7d1144553", "row_index": 53, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d8b2e29-512c-406a-a89c-18e7d1144553", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd5bc6cd-9e3a-4f3a-ab59-4a8cf35d7ae9", "record_id": "flaws_cloudtrail:0000054:dd5bc6cd-9e3a-4f3a-ab59-4a8cf35d7ae9", "row_index": 54, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd5bc6cd-9e3a-4f3a-ab59-4a8cf35d7ae9", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80601-4fb1-4007-a826-7798b436b6df", "record_id": "flaws_cloudtrail:0000055:80601-4fb1-4007-a826-7798b436b6df", "row_index": 55, "timestamp": "2018-10-12T15:08:41Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80601-4fb1-4007-a826-7798b436b6df", "eventTime": "2018-10-12T15:08:41Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4acb491b-66f8-40ce-a63d-b1e56f99fac1", "record_id": "flaws_cloudtrail:0000056:4acb491b-66f8-40ce-a63d-b1e56f99fac1", "row_index": 56, "timestamp": "2018-10-12T15:08:42Z", "event_type": "DescribeVpcPeeringConnections", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4acb491b-66f8-40ce-a63d-b1e56f99fac1", "eventTime": "2018-10-12T15:08:42Z", "eventName": "DescribeVpcPeeringConnections", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcPeeringConnectionIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59bafa58-ce1d-4e54-ae00-316c290abeaa", "record_id": "flaws_cloudtrail:0000057:59bafa58-ce1d-4e54-ae00-316c290abeaa", "row_index": 57, "timestamp": "2018-10-12T15:08:45Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59bafa58-ce1d-4e54-ae00-316c290abeaa", "eventTime": "2018-10-12T15:08:45Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2e52765-1a38-4126-8c00-da1781f13cae", "record_id": "flaws_cloudtrail:0000058:c2e52765-1a38-4126-8c00-da1781f13cae", "row_index": 58, "timestamp": "2018-10-12T15:08:45Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2e52765-1a38-4126-8c00-da1781f13cae", "eventTime": "2018-10-12T15:08:45Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "591eef8d-8ae4-4f45-8996-38022adac7", "record_id": "flaws_cloudtrail:0000059:591eef8d-8ae4-4f45-8996-38022adac7", "row_index": 59, "timestamp": "2018-10-12T15:08:45Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 684, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "591eef8d-8ae4-4f45-8996-38022adac7", "eventTime": "2018-10-12T15:08:45Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4990f075-4bbf-4ef4-a7d8-01f6f37b1ad4", "record_id": "flaws_cloudtrail:0000060:4990f075-4bbf-4ef4-a7d8-01f6f37b1ad4", "row_index": 60, "timestamp": "2018-10-12T15:08:45Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4990f075-4bbf-4ef4-a7d8-01f6f37b1ad4", "eventTime": "2018-10-12T15:08:45Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf701dcd-c815-40cd-b6b9-fc4b81ec48d9", "record_id": "flaws_cloudtrail:0000061:bf701dcd-c815-40cd-b6b9-fc4b81ec48d9", "row_index": 61, "timestamp": "2018-10-12T15:08:45Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf701dcd-c815-40cd-b6b9-fc4b81ec48d9", "eventTime": "2018-10-12T15:08:45Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "caa04036-af53-4f3f-ad00-fcd2a15a8588", "record_id": "flaws_cloudtrail:0000062:caa04036-af53-4f3f-ad00-fcd2a15a8588", "row_index": 62, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "caa04036-af53-4f3f-ad00-fcd2a15a8588", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8ce56de-718e-43bf-99ec-5b3a63586ed4", "record_id": "flaws_cloudtrail:0000063:b8ce56de-718e-43bf-99ec-5b3a63586ed4", "row_index": 63, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8ce56de-718e-43bf-99ec-5b3a63586ed4", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c70ac980-dd9a-4977-acc4-131e20e54442", "record_id": "flaws_cloudtrail:0000064:c70ac980-dd9a-4977-acc4-131e20e54442", "row_index": 64, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 686, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c70ac980-dd9a-4977-acc4-131e20e54442", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb7e4a08-0591-46a5-969e-4d7544933691", "record_id": "flaws_cloudtrail:0000065:fb7e4a08-0591-46a5-969e-4d7544933691", "row_index": 65, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb7e4a08-0591-46a5-969e-4d7544933691", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e336dd8-6a00-4ce8-9a85-12bcaeacc033", "record_id": "flaws_cloudtrail:0000066:9e336dd8-6a00-4ce8-9a85-12bcaeacc033", "row_index": 66, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e336dd8-6a00-4ce8-9a85-12bcaeacc033", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a079a4a-0b48-4454-acc0-1500b1d58712", "record_id": "flaws_cloudtrail:0000067:4a079a4a-0b48-4454-acc0-1500b1d58712", "row_index": 67, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a079a4a-0b48-4454-acc0-1500b1d58712", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe65e4ad-619b-468d-aef3-94a0392fbdff", "record_id": "flaws_cloudtrail:0000068:fe65e4ad-619b-468d-aef3-94a0392fbdff", "row_index": 68, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe65e4ad-619b-468d-aef3-94a0392fbdff", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f79ada6-7bdf-4518-b2e2-f0d2bf516735", "record_id": "flaws_cloudtrail:0000069:5f79ada6-7bdf-4518-b2e2-f0d2bf516735", "row_index": 69, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f79ada6-7bdf-4518-b2e2-f0d2bf516735", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f73896c4-6063-4ed5-bb59-50e772bf93b3", "record_id": "flaws_cloudtrail:0000070:f73896c4-6063-4ed5-bb59-50e772bf93b3", "row_index": 70, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 682, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f73896c4-6063-4ed5-bb59-50e772bf93b3", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b8eda16-9176-478c-ba5f-f0aa38691bc7", "record_id": "flaws_cloudtrail:0000071:6b8eda16-9176-478c-ba5f-f0aa38691bc7", "row_index": 71, "timestamp": "2018-10-12T15:08:46Z", "event_type": "ListClusters", "event_source": "elasticmapreduce.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b8eda16-9176-478c-ba5f-f0aa38691bc7", "eventTime": "2018-10-12T15:08:46Z", "eventName": "ListClusters", "eventSource": "elasticmapreduce.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58d4db3f-dd9f-40ef-bc7f-3fd234010917", "record_id": "flaws_cloudtrail:0000072:58d4db3f-dd9f-40ef-bc7f-3fd234010917", "row_index": 72, "timestamp": "2018-10-12T15:08:48Z", "event_type": "DescribeConnections", "event_source": "directconnect.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58d4db3f-dd9f-40ef-bc7f-3fd234010917", "eventTime": "2018-10-12T15:08:48Z", "eventName": "DescribeConnections", "eventSource": "directconnect.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fa8d079-9b23-4cb2-a99e-0bcb8eea89b9", "record_id": "flaws_cloudtrail:0000073:9fa8d079-9b23-4cb2-a99e-0bcb8eea89b9", "row_index": 73, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fa8d079-9b23-4cb2-a99e-0bcb8eea89b9", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1f886a6-f881-4bd7-b766-5e9c8cab6125", "record_id": "flaws_cloudtrail:0000074:d1f886a6-f881-4bd7-b766-5e9c8cab6125", "row_index": 74, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1f886a6-f881-4bd7-b766-5e9c8cab6125", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "806ba9d2-84b9-4b37-89ac-0cfa1b85cae0", "record_id": "flaws_cloudtrail:0000075:806ba9d2-84b9-4b37-89ac-0cfa1b85cae0", "row_index": 75, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "806ba9d2-84b9-4b37-89ac-0cfa1b85cae0", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bb3a2b6-63d1-4d38-9383-7d9a0f2009c2", "record_id": "flaws_cloudtrail:0000076:6bb3a2b6-63d1-4d38-9383-7d9a0f2009c2", "row_index": 76, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bb3a2b6-63d1-4d38-9383-7d9a0f2009c2", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc61485b-85cf-4440-9be7-6757b508f709", "record_id": "flaws_cloudtrail:0000077:fc61485b-85cf-4440-9be7-6757b508f709", "row_index": 77, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc61485b-85cf-4440-9be7-6757b508f709", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c7b0498d-5009-44cc-a73f-172f430f63cf", "record_id": "flaws_cloudtrail:0000078:c7b0498d-5009-44cc-a73f-172f430f63cf", "row_index": 78, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c7b0498d-5009-44cc-a73f-172f430f63cf", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72320c45-2431-44d7-9f8a-ee26512d6a55", "record_id": "flaws_cloudtrail:0000079:72320c45-2431-44d7-9f8a-ee26512d6a55", "row_index": 79, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72320c45-2431-44d7-9f8a-ee26512d6a55", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "158984-549d-47a6-98d8-806e5346e047", "record_id": "flaws_cloudtrail:0000080:158984-549d-47a6-98d8-806e5346e047", "row_index": 80, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "158984-549d-47a6-98d8-806e5346e047", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c64986a8-6535-408d-9fcc-967112599024", "record_id": "flaws_cloudtrail:0000081:c64986a8-6535-408d-9fcc-967112599024", "row_index": 81, "timestamp": "2018-10-12T15:08:49Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c64986a8-6535-408d-9fcc-967112599024", "eventTime": "2018-10-12T15:08:49Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f6e6b0f-4019-4caa-b18d-425ee12f6331", "record_id": "flaws_cloudtrail:0000082:5f6e6b0f-4019-4caa-b18d-425ee12f6331", "row_index": 82, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f6e6b0f-4019-4caa-b18d-425ee12f6331", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31a8479f-a730-43f9-a90c-d78dbbe06805", "record_id": "flaws_cloudtrail:0000083:31a8479f-a730-43f9-a90c-d78dbbe06805", "row_index": 83, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31a8479f-a730-43f9-a90c-d78dbbe06805", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea98f909-e308-4337-9d27-0384c10f7889", "record_id": "flaws_cloudtrail:0000084:ea98f909-e308-4337-9d27-0384c10f7889", "row_index": 84, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea98f909-e308-4337-9d27-0384c10f7889", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6c628710-671e-461d-b3c2-e2709cd4ba3c", "record_id": "flaws_cloudtrail:0000085:e6c628710-671e-461d-b3c2-e2709cd4ba3c", "row_index": 85, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6c628710-671e-461d-b3c2-e2709cd4ba3c", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5b0631f-bb6e-43ca-b6b4-2f0d6c627933c", "record_id": "flaws_cloudtrail:0000086:e5b0631f-bb6e-43ca-b6b4-2f0d6c627933c", "row_index": 86, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5b0631f-bb6e-43ca-b6b4-2f0d6c627933c", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f628a8ca-1cb7-43e1-b135-57e0d0b24e42", "record_id": "flaws_cloudtrail:0000087:f628a8ca-1cb7-43e1-b135-57e0d0b24e42", "row_index": 87, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f628a8ca-1cb7-43e1-b135-57e0d0b24e42", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2324e0f5-6a37-4265-8316-94baa02a738b", "record_id": "flaws_cloudtrail:0000088:2324e0f5-6a37-4265-8316-94baa02a738b", "row_index": 88, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2324e0f5-6a37-4265-8316-94baa02a738b", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61c59208-58d9-4915-ab47-6d4796d920d6", "record_id": "flaws_cloudtrail:0000089:61c59208-58d9-4915-ab47-6d4796d920d6", "row_index": 89, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61c59208-58d9-4915-ab47-6d4796d920d6", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29a25f59-9266-4891-a4c3-32d92269ef2e", "record_id": "flaws_cloudtrail:0000090:29a25f59-9266-4891-a4c3-32d92269ef2e", "row_index": 90, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29a25f59-9266-4891-a4c3-32d92269ef2e", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ad6e7ab-dde9-4fe0-b4ae-5b19f6d65512", "record_id": "flaws_cloudtrail:0000091:0ad6e7ab-dde9-4fe0-b4ae-5b19f6d65512", "row_index": 91, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ad6e7ab-dde9-4fe0-b4ae-5b19f6d65512", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96bf45b8-359e-4b75-b21f-16b1e03343d2", "record_id": "flaws_cloudtrail:0000092:96bf45b8-359e-4b75-b21f-16b1e03343d2", "row_index": 92, "timestamp": "2018-10-12T15:08:50Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96bf45b8-359e-4b75-b21f-16b1e03343d2", "eventTime": "2018-10-12T15:08:50Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b052d301-7c0e-49be-ae5b-03f26550db1c", "record_id": "flaws_cloudtrail:0000093:b052d301-7c0e-49be-ae5b-03f26550db1c", "row_index": 93, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b052d301-7c0e-49be-ae5b-03f26550db1c", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055a83e0-c7e9-4c28-b5e5-b2cb39b9d79e", "record_id": "flaws_cloudtrail:0000094:055a83e0-c7e9-4c28-b5e5-b2cb39b9d79e", "row_index": 94, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055a83e0-c7e9-4c28-b5e5-b2cb39b9d79e", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f01b2de0-6a01-4f8a-9984-2e786d2d7f93", "record_id": "flaws_cloudtrail:0000095:f01b2de0-6a01-4f8a-9984-2e786d2d7f93", "row_index": 95, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f01b2de0-6a01-4f8a-9984-2e786d2d7f93", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b4fa50c-3e2b-4b38-aca5-fda55394d2a8", "record_id": "flaws_cloudtrail:0000096:5b4fa50c-3e2b-4b38-aca5-fda55394d2a8", "row_index": 96, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b4fa50c-3e2b-4b38-aca5-fda55394d2a8", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55647b-6db5-4422-8253-2e76ba4d340d", "record_id": "flaws_cloudtrail:0000097:55647b-6db5-4422-8253-2e76ba4d340d", "row_index": 97, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55647b-6db5-4422-8253-2e76ba4d340d", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c014794-00f4-45ea-a630-763dbd5886df", "record_id": "flaws_cloudtrail:0000098:c014794-00f4-45ea-a630-763dbd5886df", "row_index": 98, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c014794-00f4-45ea-a630-763dbd5886df", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8738c7b-0bdc-4f2e-b3a5-2fc4e576334", "record_id": "flaws_cloudtrail:0000099:d8738c7b-0bdc-4f2e-b3a5-2fc4e576334", "row_index": 99, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8738c7b-0bdc-4f2e-b3a5-2fc4e576334", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca2846f1-16d6-4269-97e4-cf07c675249", "record_id": "flaws_cloudtrail:0000100:ca2846f1-16d6-4269-97e4-cf07c675249", "row_index": 100, "timestamp": "2018-10-12T15:08:51Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca2846f1-16d6-4269-97e4-cf07c675249", "eventTime": "2018-10-12T15:08:51Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33a3cb50-7750-4282-b7d1-95e991114b3", "record_id": "flaws_cloudtrail:0000101:33a3cb50-7750-4282-b7d1-95e991114b3", "row_index": 101, "timestamp": "2018-10-12T15:08:52Z", "event_type": "DescribeCacheSecurityGroups", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33a3cb50-7750-4282-b7d1-95e991114b3", "eventTime": "2018-10-12T15:08:52Z", "eventName": "DescribeCacheSecurityGroups", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0c09a67-14d0-49e1-acd3-4592cbda0c89", "record_id": "flaws_cloudtrail:0000102:b0c09a67-14d0-49e1-acd3-4592cbda0c89", "row_index": 102, "timestamp": "2018-10-12T15:08:52Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0c09a67-14d0-49e1-acd3-4592cbda0c89", "eventTime": "2018-10-12T15:08:52Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47e34f34-713a-46d4-a6f6-7230c128024", "record_id": "flaws_cloudtrail:0000103:47e34f34-713a-46d4-a6f6-7230c128024", "row_index": 103, "timestamp": "2018-10-12T15:08:53Z", "event_type": "ListHostedZones", "event_source": "route53.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47e34f34-713a-46d4-a6f6-7230c128024", "eventTime": "2018-10-12T15:08:53Z", "eventName": "ListHostedZones", "eventSource": "route53.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86f547d4-7f33-4659-b062-39f0589b843a", "record_id": "flaws_cloudtrail:0000104:86f547d4-7f33-4659-b062-39f0589b843a", "row_index": 104, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 671, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86f547d4-7f33-4659-b062-39f0589b843a", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aeb51f1d-f775-4319-ad57-8d5df9c324f0", "record_id": "flaws_cloudtrail:0000105:aeb51f1d-f775-4319-ad57-8d5df9c324f0", "row_index": 105, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 675, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aeb51f1d-f775-4319-ad57-8d5df9c324f0", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3dec0e3-322f-4f87-836b-d5b2f36b914d", "record_id": "flaws_cloudtrail:0000106:e3dec0e3-322f-4f87-836b-d5b2f36b914d", "row_index": 106, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3dec0e3-322f-4f87-836b-d5b2f36b914d", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "452e672a-50ed-410c-8406-a9e17aa51ba9", "record_id": "flaws_cloudtrail:0000107:452e672a-50ed-410c-8406-a9e17aa51ba9", "row_index": 107, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 873, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "452e672a-50ed-410c-8406-a9e17aa51ba9", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:ca-central-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df9170a2-a15a-4b2a-a636-e6ae4e3e385a", "record_id": "flaws_cloudtrail:0000108:df9170a2-a15a-4b2a-a636-e6ae4e3e385a", "row_index": 108, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 873, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df9170a2-a15a-4b2a-a636-e6ae4e3e385a", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:eu-central-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "028a0b88-0e7c-4df1-87d5-8ac6e81f72ab", "record_id": "flaws_cloudtrail:0000109:028a0b88-0e7c-4df1-87d5-8ac6e81f72ab", "row_index": 109, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "028a0b88-0e7c-4df1-87d5-8ac6e81f72ab", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f855676dd-6130-4d4e-90f8-095b205016a32", "record_id": "flaws_cloudtrail:0000110:f855676dd-6130-4d4e-90f8-095b205016a32", "row_index": 110, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 672, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f855676dd-6130-4d4e-90f8-095b205016a32", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "84ae5d31-4206-4b62-ba6f-5f338b3522f1", "record_id": "flaws_cloudtrail:0000111:84ae5d31-4206-4b62-ba6f-5f338b3522f1", "row_index": 111, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 867, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "84ae5d31-4206-4b62-ba6f-5f338b3522f1", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:eu-west-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38eb3b1e-f3a0-45a1-b80e-54b2371c5125", "record_id": "flaws_cloudtrail:0000112:38eb3b1e-f3a0-45a1-b80e-54b2371c5125", "row_index": 112, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38eb3b1e-f3a0-45a1-b80e-54b2371c5125", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "978bcce2-c2b9-486e-9a93-396eaa08c7a1", "record_id": "flaws_cloudtrail:0000113:978bcce2-c2b9-486e-9a93-396eaa08c7a1", "row_index": 113, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 867, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "978bcce2-c2b9-486e-9a93-396eaa08c7a1", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:eu-west-2:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e691a4bd-b66d-4fa5-aeb6-4f904418a6b", "record_id": "flaws_cloudtrail:0000114:e691a4bd-b66d-4fa5-aeb6-4f904418a6b", "row_index": 114, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 865, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e691a4bd-b66d-4fa5-aeb6-4f904418a6b", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:eu-west-3:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b843fa71-6225-421c-b1c6-d238ca956e68", "record_id": "flaws_cloudtrail:0000115:b843fa71-6225-421c-b1c6-d238ca956e68", "row_index": 115, "timestamp": "2018-10-12T15:08:54Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 668, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b843fa71-6225-421c-b1c6-d238ca956e68", "eventTime": "2018-10-12T15:08:54Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db219bec-9c1b-40a9-bfb8-157de1da14b6", "record_id": "flaws_cloudtrail:0000116:db219bec-9c1b-40a9-bfb8-157de1da14b6", "row_index": 116, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 877, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db219bec-9c1b-40a9-bfb8-157de1da14b6", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:ap-northeast-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f00eceb5-cf0e-49e3-a3ce-ec7c33562ba4", "record_id": "flaws_cloudtrail:0000117:f00eceb5-cf0e-49e3-a3ce-ec7c33562ba4", "row_index": 117, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 675, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f00eceb5-cf0e-49e3-a3ce-ec7c33562ba4", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1d3b9f3-64f8-4a81-b978-8214a114f493", "record_id": "flaws_cloudtrail:0000118:d1d3b9f3-64f8-4a81-b978-8214a114f493", "row_index": 118, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 675, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1d3b9f3-64f8-4a81-b978-8214a114f493", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "080a5a01-e920-4735-ae08-fb41166e58", "record_id": "flaws_cloudtrail:0000119:080a5a01-e920-4735-ae08-fb41166e58", "row_index": 119, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 875, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "080a5a01-e920-4735-ae08-fb41166e58", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:ap-northeast-2:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "643a1114-7ea7-48a1-a0bf-71a8b6fd8dee", "record_id": "flaws_cloudtrail:0000120:643a1114-7ea7-48a1-a0bf-71a8b6fd8dee", "row_index": 120, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 869, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "643a1114-7ea7-48a1-a0bf-71a8b6fd8dee", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:ap-south-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af181bed-a3e8-4f55-b6cc-089990cb67b8", "record_id": "flaws_cloudtrail:0000121:af181bed-a3e8-4f55-b6cc-089990cb67b8", "row_index": 121, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 877, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af181bed-a3e8-4f55-b6cc-089990cb67b8", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:ap-southeast-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a42973-b71c-44d3-a97e-f936dd0e08db", "record_id": "flaws_cloudtrail:0000122:4a42973-b71c-44d3-a97e-f936dd0e08db", "row_index": 122, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 674, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a42973-b71c-44d3-a97e-f936dd0e08db", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1695a94a-eac4-495a-b3eb-1fb5cb53469b", "record_id": "flaws_cloudtrail:0000123:1695a94a-eac4-495a-b3eb-1fb5cb53469b", "row_index": 123, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 877, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1695a94a-eac4-495a-b3eb-1fb5cb53469b", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:ap-southeast-2:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d93bbb1f-f2fb-4eef-8bab-f8a71078468e", "record_id": "flaws_cloudtrail:0000124:d93bbb1f-f2fb-4eef-8bab-f8a71078468e", "row_index": 124, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d93bbb1f-f2fb-4eef-8bab-f8a71078468e", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f5473b2-d7ce-4732-92c3-82fff7df6cb2", "record_id": "flaws_cloudtrail:0000125:1f5473b2-d7ce-4732-92c3-82fff7df6cb2", "row_index": 125, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 867, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f5473b2-d7ce-4732-92c3-82fff7df6cb2", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:sa-east-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d54d2ad9-37c9-4f85-bc89-c3887b99d8ce", "record_id": "flaws_cloudtrail:0000126:d54d2ad9-37c9-4f85-bc89-c3887b99d8ce", "row_index": 126, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d54d2ad9-37c9-4f85-bc89-c3887b99d8ce", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38eff9db-bc43-4a2c-b4f5-97fd0fcacf0b", "record_id": "flaws_cloudtrail:0000127:38eff9db-bc43-4a2c-b4f5-97fd0fcacf0b", "row_index": 127, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 867, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38eff9db-bc43-4a2c-b4f5-97fd0fcacf0b", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:us-east-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "64ca904a-484b-4921-8350-8ab3ad6f99b6", "record_id": "flaws_cloudtrail:0000128:64ca904a-484b-4921-8350-8ab3ad6f99b6", "row_index": 128, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 866, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "64ca904a-484b-4921-8350-8ab3ad6f99b6", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:us-east-2:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0571b151-3382-41c9-9cdb-3934ac07b6ba", "record_id": "flaws_cloudtrail:0000129:0571b151-3382-41c9-9cdb-3934ac07b6ba", "row_index": 129, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0571b151-3382-41c9-9cdb-3934ac07b6ba", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "28878f3-f74f-4158-b3aa-b8b85af13917", "record_id": "flaws_cloudtrail:0000130:28878f3-f74f-4158-b3aa-b8b85af13917", "row_index": 130, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 666, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "28878f3-f74f-4158-b3aa-b8b85af13917", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e651bb0-716c-4ddb-ac2a-92bb05a6b765", "record_id": "flaws_cloudtrail:0000131:3e651bb0-716c-4ddb-ac2a-92bb05a6b765", "row_index": 131, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 865, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e651bb0-716c-4ddb-ac2a-92bb05a6b765", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:us-west-1:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "922b281f-a230-4ee7-8883-ebfd3f4ed2c8", "record_id": "flaws_cloudtrail:0000132:922b281f-a230-4ee7-8883-ebfd3f4ed2c8", "row_index": 132, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListSubscriptions", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 864, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "922b281f-a230-4ee7-8883-ebfd3f4ed2c8", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListSubscriptions", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:us-west-2:811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7b36788-5895-4520-9fef-f445ce9e37eb", "record_id": "flaws_cloudtrail:0000133:b7b36788-5895-4520-9fef-f445ce9e37eb", "row_index": 133, "timestamp": "2018-10-12T15:08:57Z", "event_type": "ListTopics", "event_source": "sns.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7b36788-5895-4520-9fef-f445ce9e37eb", "eventTime": "2018-10-12T15:08:57Z", "eventName": "ListTopics", "eventSource": "sns.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8b3818b-97b9-4023-8b21-a58c853068", "record_id": "flaws_cloudtrail:0000134:b8b3818b-97b9-4023-8b21-a58c853068", "row_index": 134, "timestamp": "2018-10-12T15:08:58Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.251.253.46", "user_agent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8b3818b-97b9-4023-8b21-a58c853068", "eventTime": "2018-10-12T15:08:58Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.251.253.46", "userAgent": "Boto3/1.9.20 Python/2.7.15+ Linux/4.18.0-kali1-amd64 Botocore/1.12.21", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70b4535a-2cd4-4f89-bbef-0497ef5b90da", "record_id": "flaws_cloudtrail:0000135:70b4535a-2cd4-4f89-bbef-0497ef5b90da", "row_index": 135, "timestamp": "2018-10-12T16:01:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1495, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70b4535a-2cd4-4f89-bbef-0497ef5b90da", "eventTime": "2018-10-12T16:01:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8RMRNOVCYVSV2CJM", "expiration": "Oct 12, 2018 10:34:40 PM", "sessionToken": "FQoGZXIvYXdzEOH//////////wEaDOHt5eC6ubYzNTthkCK3A96cNdXstIkY4X58uC8lfv1ZWdfwOf6rX46jeo5gj01mT+UQ80qigjBI/Wv92lPRgc54/koeu9v+BIWEnkrc25xQIwKtluF1ZKZOu+DnYeojjkEEqyTq0oA1RknFSdxHT1S30WMqMGmjVZAikBrpH2asv3SeLp2QCOoK4qDcq43B+6BKmAqVpUuX0Fsvbs0rRfQNtqvnKQtBPQpH5HMMNSVahRSzBsBc+F2JVib5GSbUzCEF+dlpdiIOIahoo1+3gpmu5G8CpuQ38v0s7AIvwEwh/9QcPztpysgilCtIcBTyNUIT7YaXW2XRWliYWNQHIfNKxMpKeMNfnQocGg5Yz5RG7ULIcYIo+YG9ZsOgvB6k5BSSmTWnqJZmwUIS0E65oKQO54bJaF9ERXQlu4sWsCpLTv2fRVusNFHnyHPaVmhRMhthvHBdslp1yjcpQbgiqjFDlYr9us8DmGj6dTm1nkmYYviwsBfsvaIwjKM52y1QjI1vqexZxQXlUSzFoYouuSMWakq+O/cUPvE8Bx0qHVSd3Y3DOE7BJsTRlZs5y9dQeNrqafueI8tdgD+Ese+U0UA8/Py9L3so5IqD3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf900403-e236-45da-b083-6a50bd45ee00", "record_id": "flaws_cloudtrail:0000136:bf900403-e236-45da-b083-6a50bd45ee00", "row_index": 136, "timestamp": "2018-10-12T16:59:15Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.251.43.54", "user_agent": "[aws-cli/1.16.32 Python/3.6.0 Windows/10 botocore/1.12.22]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 635, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf900403-e236-45da-b083-6a50bd45ee00", "eventTime": "2018-10-12T16:59:15Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.251.43.54", "userAgent": "[aws-cli/1.16.32 Python/3.6.0 Windows/10 botocore/1.12.22]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f7b2815-84a2-4b83-9be6-f5178ce48d8c", "record_id": "flaws_cloudtrail:0000137:3f7b2815-84a2-4b83-9be6-f5178ce48d8c", "row_index": 137, "timestamp": "2018-10-12T17:01:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1495, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f7b2815-84a2-4b83-9be6-f5178ce48d8c", "eventTime": "2018-10-12T17:01:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXNL4971WNARHH1KC", "expiration": "Oct 12, 2018 11:25:00 PM", "sessionToken": "FQoGZXIvYXdzEOL//////////wEaDLj8kEZk4tFYjxtz1SK3A9NhN+Ii/wWRwp9/E/Ec5vBKip9VuNNxxJeajVbQNwrDuyHnLIMcLljf+/MtcauZ101IksfzXxy/P/cSLm8e2rfW3tIhdCevha4DeLvGDwTkTldmyk4TVZbSy2AQFMbNGPSbVJGO07WTy1yLUeSjBaxaSxf60qK7SpU6CPUK4A7shw966b4DxWRFpyBPnXjt8yDz/qDopHqrITyjib5uiYlsw6Fi16/ez2Dn1P2DXu3u81mmmcJXSBaJ80H07xX4GRUQoWb98U8cKbZB4BGUAP83OpMvWjbWxYZBABagAjgGyuEaMf0kqc2ZpUPV2KX0DIipT6HZcYFIVmDPHVQv+/aLSNIh8PpAhfSyJujBOGq4OeEjcfX1XiS+Ka3PuOnhC+rAR2+jwHUnuTQBNUDHL0v6crW/PeIakNEu6k4q2XBtIH7kG4QkZa8tRCke0W/RFH+PeOAqFaOVe6m3sZvLEsyh5Z/zJAUXZgwgcB/4IKHgK1Q8V0GcElTaBIXzDA19oWp1mgGKtOvElLLKzvKw1snNGRhe3DYdmkhW1AUU0BxldW/RTGKAF/YwASCMfoqNc7JxjByt/uko9KaD3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e559ddb0-2194-421f-ab5b-bcd11d92aa8a", "record_id": "flaws_cloudtrail:0000138:e559ddb0-2194-421f-ab5b-bcd11d92aa8a", "row_index": 138, "timestamp": "2018-10-12T17:49:42Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIACIFRPMS7F3VTG66C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "122.121.35.212", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 514, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e559ddb0-2194-421f-ab5b-bcd11d92aa8a", "eventTime": "2018-10-12T17:49:42Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "122.121.35.212", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIACIFRPMS7F3VTG66C", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0169c7d1-168b-4261-b14f-b9ac671b0c69", "record_id": "flaws_cloudtrail:0000139:0169c7d1-168b-4261-b14f-b9ac671b0c69", "row_index": 139, "timestamp": "2018-10-12T17:49:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1924, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0169c7d1-168b-4261-b14f-b9ac671b0c69", "eventTime": "2018-10-12T17:49:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAPMGLO8KCLW7H9ZP2", "expiration": "Oct 12, 2018 6:49:55 PM", "sessionToken": "AgoGb3JpZ2luECYaCXVzLXdlc3QtMiKAApGZBHzAbv0KdUtAnoA2fteitii6QKbS8df9SGsbzyymMCFdJSILGqiTDoVSooHhGM2peol5iYN+AWYDw7t9hzokUPQzSoU2xuIWwWv0FyK6vCEu8tr7e2SZb5dUzespmf4taecqB70BP7pZIU+rnQQwmBRm4YHWcse+2Q32KOMEMxB34cRcdEMJp5NE34FKMkF5OFh0T1N2fxvYYboO7RrofkH5p9Q6YqMj+AAVMeXJZjZKsONT9Oj3n2th1JW+xI9gAZwIODNG5SJzRPq1GTUfYoKWCiHmH73VNn+FKnT1nwZjYis9XNTBbQH1InEsdetHmClsvX2shsvYa/AnrE8q6AIIexAAGgw5NzU0MjYyNjIwMjkiDHcGUxQqB4gBPor/xCrFAij2zQnywUPh/+j4+tTYPZpDglv5wlJlfZgrBO7JiLCX1RzvA/3+1/IkUjUK24lpkErpQN0eZ3bfJ5poTDWdBsv1X3R22vGeNEbzi1cu5k7vDX0b0h4mC5aXlQZ4bMjLQhN1sPYz1oAGMMK5N6J9IddwU6YGcQl7QrBHjISSFE1c48j1Lx0tlFx7WTmdIOgUX2FbGmjiV62zhgCcg7jfdyhJJJ8cSpSXvaTPYREq9Bqsb1hIGZrUHLyKyqC78Yqs5twlJ81TRSKouKVSMxAnpKau1NsSHV1o3ebfokPoO2AWEpb7ZX9gprbnltcL/Td4SZ8bt/LJIm8l4WM4oqlYYLwzgVlLG6WMgAjEVNI9yFRwYYaHPzhnMaxUcgbCWnzoTo+XIIfHlZdHTTTFgqnCe7f8M60R+qAG/xBVevjgJSli3/Pd388ww72D3gU="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "239380ad-2b38-4a92-8139-473e3f57c523", "record_id": "flaws_cloudtrail:0000140:239380ad-2b38-4a92-8139-473e3f57c523", "row_index": 140, "timestamp": "2018-10-12T17:50:24Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIACIFRPMS7F3VTG66C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "122.121.35.212", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 543, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "239380ad-2b38-4a92-8139-473e3f57c523", "eventTime": "2018-10-12T17:50:24Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "122.121.35.212", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIACIFRPMS7F3VTG66C", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69e7e6ce-5d01-4b1f-8be3-6cc9b24b6aca", "record_id": "flaws_cloudtrail:0000141:69e7e6ce-5d01-4b1f-8be3-6cc9b24b6aca", "row_index": 141, "timestamp": "2018-10-12T17:52:41Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIACIFRPMS7F3VTG66C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "122.121.35.212", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 553, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69e7e6ce-5d01-4b1f-8be3-6cc9b24b6aca", "eventTime": "2018-10-12T17:52:41Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "122.121.35.212", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIACIFRPMS7F3VTG66C", "userName": "backup"}, "requestParameters": {"userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9193480-f055-47a0-8108-a13938dc8b65", "record_id": "flaws_cloudtrail:0000142:a9193480-f055-47a0-8108-a13938dc8b65", "row_index": 142, "timestamp": "2018-10-12T17:54:51Z", "event_type": "CreateUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIACIFRPMS7F3VTG66C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "122.121.35.212", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:user/backup-bot-270"], "raw_record_size_bytes": 627, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9193480-f055-47a0-8108-a13938dc8b65", "eventTime": "2018-10-12T17:54:51Z", "eventName": "CreateUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "122.121.35.212", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIACIFRPMS7F3VTG66C", "userName": "backup"}, "requestParameters": {"userName": "backup-bot-270"}, "resources": [{"ARN": "arn:aws:iam::811596193553:user/backup-bot-270"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8c79e22-eeb3-4d98-8266-fcfeda822655", "record_id": "flaws_cloudtrail:0000143:d8c79e22-eeb3-4d98-8266-fcfeda822655", "row_index": 143, "timestamp": "2018-10-12T17:55:41Z", "event_type": "CreateAccessKey", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIACIFRPMS7F3VTG66C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "122.121.35.212", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:user/backup-bot-270"], "raw_record_size_bytes": 632, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8c79e22-eeb3-4d98-8266-fcfeda822655", "eventTime": "2018-10-12T17:55:41Z", "eventName": "CreateAccessKey", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "122.121.35.212", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIACIFRPMS7F3VTG66C", "userName": "backup"}, "requestParameters": {"userName": "backup-bot-270"}, "resources": [{"ARN": "arn:aws:iam::811596193553:user/backup-bot-270"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8ab48b1-e865-410c-92a8-d181846fd7c0", "record_id": "flaws_cloudtrail:0000144:d8ab48b1-e865-410c-92a8-d181846fd7c0", "row_index": 144, "timestamp": "2018-10-12T17:56:37Z", "event_type": "AttachUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIACIFRPMS7F3VTG66C", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "122.121.35.212", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:user/backup-bot-270", "arn:aws:iam::aws:policy/AmazonS3FullAccess"], "raw_record_size_bytes": 743, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8ab48b1-e865-410c-92a8-d181846fd7c0", "eventTime": "2018-10-12T17:56:37Z", "eventName": "AttachUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "122.121.35.212", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIACIFRPMS7F3VTG66C", "userName": "backup"}, "requestParameters": {"userName": "backup-bot-270", "policyArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess"}, "resources": [{"ARN": "arn:aws:iam::811596193553:user/backup-bot-270"}, {"ARN": "arn:aws:iam::aws:policy/AmazonS3FullAccess"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8dcd5121-8712-4193-9918-203878c9432c7", "record_id": "flaws_cloudtrail:0000145:8dcd5121-8712-4193-9918-203878c9432c7", "row_index": 145, "timestamp": "2018-10-12T18:01:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1493, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8dcd5121-8712-4193-9918-203878c9432c7", "eventTime": "2018-10-12T18:01:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZ6KM08FSYIXAOYQ1", "expiration": "Oct 13, 2018 12:10:40 AM", "sessionToken": "FQoGZXIvYXdzEOP//////////wEaDArWgRXH4r1U7V9+PCK3AxYLVfguJQPcR1/Cx/v21+i0zlLKWd2/3uCM2K7AoEKU8CKiKJEsyACn7LN39zQ7L8DZe/Pj5VStcnz1AFaP+MFnu7ffZ28+wp0TyD/oinvwZWDjOVC1k6aIx1+NN417d/N7H4suB4Nuzn3VmHZCMeHLtX/9lHVIdPjl7X3orW7MoZoNtXGhXQJDg3UzCwtdr+7YMx3lUEDXoPvhmG9BsYJt0zh0K4ylmyuudSWU9lQtgpuM1KifyXhU7HP+gMY3bLPI0XNfGEaFEaxjhMURC4Gbz0zOP+yDeKO7UUyjrbEVg5LxjeP+X01MPHuZBVnveHjTDM4NJQedAZeqtUWFsJw9vJ/l8R8BmR35Ltkksk0R/mnY/U7LAG8p+wXQlOmKBCCbQ5BL/kWK96kyw+UtSCCNKVYVnMFRfZpSBwgFKUQVWiU8oxHSpn2sPXQdhFwIiOYvUQD/TXWmLDlGfNZjrOzD8ZldjEHRUz51sk+BbuGgmHuvwB+/X7FUtVGdw4jiwMkLwh6khZhugzEnZIxpr76Mac/Cgm4dw6V4kAiX7XlfNPklc6PbRTbeobrk3kNLCKjUjwf2ZXwohMOD3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc00a34f-19c4-41bb-bcf2-0b073c7dd576", "record_id": "flaws_cloudtrail:0000146:dc00a34f-19c4-41bb-bcf2-0b073c7dd576", "row_index": 146, "timestamp": "2018-10-12T18:08:04Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc00a34f-19c4-41bb-bcf2-0b073c7dd576", "eventTime": "2018-10-12T18:08:04Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountSummary on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "660a13c8-3fb5-45c7-bc4d-6b3d73bfd9d3", "record_id": "flaws_cloudtrail:0000147:660a13c8-3fb5-45c7-bc4d-6b3d73bfd9d3", "row_index": 147, "timestamp": "2018-10-12T18:08:05Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 793, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "660a13c8-3fb5-45c7-bc4d-6b3d73bfd9d3", "eventTime": "2018-10-12T18:08:05Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUserPolicies on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e95a5822-33c4-499f-8c68-ce281af5fe42", "record_id": "flaws_cloudtrail:0000148:e95a5822-33c4-499f-8c68-ce281af5fe42", "row_index": 148, "timestamp": "2018-10-12T18:08:05Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e95a5822-33c4-499f-8c68-ce281af5fe42", "eventTime": "2018-10-12T18:08:05Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountSummary on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59d088aa-4c80-4651-baab-805f1583c669", "record_id": "flaws_cloudtrail:0000149:59d088aa-4c80-4651-baab-805f1583c669", "row_index": 149, "timestamp": "2018-10-12T18:08:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 659, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59d088aa-4c80-4651-baab-805f1583c669", "eventTime": "2018-10-12T18:08:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31a6540b-0f64-45a3-8fa1-05904ae3c8ef", "record_id": "flaws_cloudtrail:0000150:31a6540b-0f64-45a3-8fa1-05904ae3c8ef", "row_index": 150, "timestamp": "2018-10-12T18:08:06Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31a6540b-0f64-45a3-8fa1-05904ae3c8ef", "eventTime": "2018-10-12T18:08:06Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ac37b14-5ba7-4f77-9e47-19a9f4359b8b", "record_id": "flaws_cloudtrail:0000151:2ac37b14-5ba7-4f77-9e47-19a9f4359b8b", "row_index": 151, "timestamp": "2018-10-12T18:08:06Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ac37b14-5ba7-4f77-9e47-19a9f4359b8b", "eventTime": "2018-10-12T18:08:06Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5bac8033-6762-4a9b-a120-319916b5e5fb1", "record_id": "flaws_cloudtrail:0000152:5bac8033-6762-4a9b-a120-319916b5e5fb1", "row_index": 152, "timestamp": "2018-10-12T18:08:07Z", "event_type": "DescribeDBInstances", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5bac8033-6762-4a9b-a120-319916b5e5fb1", "eventTime": "2018-10-12T18:08:07Z", "eventName": "DescribeDBInstances", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: rds:DescribeDBInstances", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c43e74e1-7814-4afa-a138-7c87f6d2b7f1", "record_id": "flaws_cloudtrail:0000153:c43e74e1-7814-4afa-a138-7c87f6d2b7f1", "row_index": 153, "timestamp": "2018-10-12T18:08:08Z", "event_type": "DescribeDBSecurityGroups", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c43e74e1-7814-4afa-a138-7c87f6d2b7f1", "eventTime": "2018-10-12T18:08:08Z", "eventName": "DescribeDBSecurityGroups", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: rds:DescribeDBSecurityGroups", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcdf5683-777f-4e8d-be30-a67bf3112bff", "record_id": "flaws_cloudtrail:0000154:bcdf5683-777f-4e8d-be30-a67bf3112bff", "row_index": 154, "timestamp": "2018-10-12T18:08:08Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto/2.10.0 (linux2)", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 773, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcdf5683-777f-4e8d-be30-a67bf3112bff", "eventTime": "2018-10-12T18:08:08Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto/2.10.0 (linux2)", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: rds:DescribeDBSnapshots", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e323205-46ac-4c94-ab9d-87d24fce1183", "record_id": "flaws_cloudtrail:0000155:e323205-46ac-4c94-ab9d-87d24fce1183", "row_index": 155, "timestamp": "2018-10-12T18:10:05Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 649, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e323205-46ac-4c94-ab9d-87d24fce1183", "eventTime": "2018-10-12T18:10:05Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4614b7e5-8be8-450b-b058-143c6bef8cd8", "record_id": "flaws_cloudtrail:0000156:4614b7e5-8be8-450b-b058-143c6bef8cd8", "row_index": 156, "timestamp": "2018-10-12T18:14:31Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4614b7e5-8be8-450b-b058-143c6bef8cd8", "eventTime": "2018-10-12T18:14:31Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f6ec157-9aaf-4cad-b2f8-85cbc7198b5a", "record_id": "flaws_cloudtrail:0000157:7f6ec157-9aaf-4cad-b2f8-85cbc7198b5a", "row_index": 157, "timestamp": "2018-10-12T18:14:32Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f6ec157-9aaf-4cad-b2f8-85cbc7198b5a", "eventTime": "2018-10-12T18:14:32Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5c66d25-fde8-475a-9001-4d33b483c448", "record_id": "flaws_cloudtrail:0000158:d5c66d25-fde8-475a-9001-4d33b483c448", "row_index": 158, "timestamp": "2018-10-12T18:14:46Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5c66d25-fde8-475a-9001-4d33b483c448", "eventTime": "2018-10-12T18:14:46Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListGroupsForUser on resource: user flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b363f6a-5318-45d5-8105-69e8f905d0bf", "record_id": "flaws_cloudtrail:0000159:9b363f6a-5318-45d5-8105-69e8f905d0bf", "row_index": 159, "timestamp": "2018-10-12T18:14:47Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 849, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b363f6a-5318-45d5-8105-69e8f905d0bf", "eventTime": "2018-10-12T18:14:47Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListAttachedUserPolicies on resource: role flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13c40938-161a-4a25-bdde-08fb78541789", "record_id": "flaws_cloudtrail:0000160:13c40938-161a-4a25-bdde-08fb78541789", "row_index": 160, "timestamp": "2018-10-12T18:14:47Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13c40938-161a-4a25-bdde-08fb78541789", "eventTime": "2018-10-12T18:14:47Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUserPolicies on resource: user flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a47414e0-445e-4355-af88-6e207093", "record_id": "flaws_cloudtrail:0000161:a47414e0-445e-4355-af88-6e207093", "row_index": 161, "timestamp": "2018-10-12T18:16:23Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a47414e0-445e-4355-af88-6e207093", "eventTime": "2018-10-12T18:16:23Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8acf3ef-81f8-4a24-9f90-513f48bbfbbd", "record_id": "flaws_cloudtrail:0000162:c8acf3ef-81f8-4a24-9f90-513f48bbfbbd", "row_index": 162, "timestamp": "2018-10-12T18:16:24Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8acf3ef-81f8-4a24-9f90-513f48bbfbbd", "eventTime": "2018-10-12T18:16:24Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3df62d52-8d97-457d-bd9b-52582f81a7fb", "record_id": "flaws_cloudtrail:0000163:3df62d52-8d97-457d-bd9b-52582f81a7fb", "row_index": 163, "timestamp": "2018-10-12T18:16:29Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3df62d52-8d97-457d-bd9b-52582f81a7fb", "eventTime": "2018-10-12T18:16:29Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1c6e497-883f-45b9-99ac-49bb5b658e68", "record_id": "flaws_cloudtrail:0000164:e1c6e497-883f-45b9-99ac-49bb5b658e68", "row_index": 164, "timestamp": "2018-10-12T18:16:30Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1c6e497-883f-45b9-99ac-49bb5b658e68", "eventTime": "2018-10-12T18:16:30Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2737a162-088e-4c76-86b8-938ee7fafe61", "record_id": "flaws_cloudtrail:0000165:2737a162-088e-4c76-86b8-938ee7fafe61", "row_index": 165, "timestamp": "2018-10-12T18:16:35Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 835, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2737a162-088e-4c76-86b8-938ee7fafe61", "eventTime": "2018-10-12T18:16:35Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListGroupsForUser on resource: user flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09f38e66-b336-4110-91b9-72ca580ad2ce", "record_id": "flaws_cloudtrail:0000166:09f38e66-b336-4110-91b9-72ca580ad2ce", "row_index": 166, "timestamp": "2018-10-12T18:16:36Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09f38e66-b336-4110-91b9-72ca580ad2ce", "eventTime": "2018-10-12T18:16:36Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUserPolicies on resource: user flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ef9aa54-c106-475d-aa8e-d25c2652b515", "record_id": "flaws_cloudtrail:0000167:6ef9aa54-c106-475d-aa8e-d25c2652b515", "row_index": 167, "timestamp": "2018-10-12T18:16:36Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 849, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ef9aa54-c106-475d-aa8e-d25c2652b515", "eventTime": "2018-10-12T18:16:36Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListAttachedUserPolicies on resource: role flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f363befd-6740-4458-aab3-e7eabe447224", "record_id": "flaws_cloudtrail:0000168:f363befd-6740-4458-aab3-e7eabe447224", "row_index": 168, "timestamp": "2018-10-12T18:17:33Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f363befd-6740-4458-aab3-e7eabe447224", "eventTime": "2018-10-12T18:17:33Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "853134-c73e-4a2e-9897-80fff3ed6dc6", "record_id": "flaws_cloudtrail:0000169:853134-c73e-4a2e-9897-80fff3ed6dc6", "row_index": 169, "timestamp": "2018-10-12T18:17:33Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 829, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "853134-c73e-4a2e-9897-80fff3ed6dc6", "eventTime": "2018-10-12T18:17:33Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "143540a-90b3-48e6-9158-669c07bc6bb8", "record_id": "flaws_cloudtrail:0000170:143540a-90b3-48e6-9158-669c07bc6bb8", "row_index": 170, "timestamp": "2018-10-12T18:17:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "143540a-90b3-48e6-9158-669c07bc6bb8", "eventTime": "2018-10-12T18:17:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92c653465-1b2d-4cf1-918a-de857cda4c5e", "record_id": "flaws_cloudtrail:0000171:92c653465-1b2d-4cf1-918a-de857cda4c5e", "row_index": 171, "timestamp": "2018-10-12T18:17:34Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92c653465-1b2d-4cf1-918a-de857cda4c5e", "eventTime": "2018-10-12T18:17:34Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bf225b7-c64d-493d-af61-af33c1be1f13", "record_id": "flaws_cloudtrail:0000172:6bf225b7-c64d-493d-af61-af33c1be1f13", "row_index": 172, "timestamp": "2018-10-12T18:17:34Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bf225b7-c64d-493d-af61-af33c1be1f13", "eventTime": "2018-10-12T18:17:34Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {"MaxResults": 500}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc761c80-1ef5-428d-b608-05c6be37cade", "record_id": "flaws_cloudtrail:0000173:dc761c80-1ef5-428d-b608-05c6be37cade", "row_index": 173, "timestamp": "2018-10-12T18:17:34Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc761c80-1ef5-428d-b608-05c6be37cade", "eventTime": "2018-10-12T18:17:34Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c19da488-43b5-488b-8ba3-66b09a3b4fbd", "record_id": "flaws_cloudtrail:0000174:c19da488-43b5-488b-8ba3-66b09a3b4fbd", "row_index": 174, "timestamp": "2018-10-12T18:17:35Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c19da488-43b5-488b-8ba3-66b09a3b4fbd", "eventTime": "2018-10-12T18:17:35Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeNatGatewaysRequest": {"MaxResults": 1000}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffe18fe3-673f-4e1a-ad4e-0e781043bb58", "record_id": "flaws_cloudtrail:0000175:ffe18fe3-673f-4e1a-ad4e-0e781043bb58", "row_index": 175, "timestamp": "2018-10-12T18:17:35Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffe18fe3-673f-4e1a-ad4e-0e781043bb58", "eventTime": "2018-10-12T18:17:35Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f196a5bc-00eb-4af6-8f37-a7b37527ff5f", "record_id": "flaws_cloudtrail:0000176:f196a5bc-00eb-4af6-8f37-a7b37527ff5f", "row_index": 176, "timestamp": "2018-10-12T18:17:36Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f196a5bc-00eb-4af6-8f37-a7b37527ff5f", "eventTime": "2018-10-12T18:17:36Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04307bd4-0093-4c2f-8700-ff65afc9569c", "record_id": "flaws_cloudtrail:0000177:04307bd4-0093-4c2f-8700-ff65afc9569c", "row_index": 177, "timestamp": "2018-10-12T18:17:36Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04307bd4-0093-4c2f-8700-ff65afc9569c", "eventTime": "2018-10-12T18:17:36Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1ea8603-e8e8-469e-92d8-a9823b59e086", "record_id": "flaws_cloudtrail:0000178:b1ea8603-e8e8-469e-92d8-a9823b59e086", "row_index": 178, "timestamp": "2018-10-12T18:17:36Z", "event_type": "DescribeRouteTables", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1ea8603-e8e8-469e-92d8-a9823b59e086", "eventTime": "2018-10-12T18:17:36Z", "eventName": "DescribeRouteTables", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"routeTableIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3183e29f-a346-449f-8818-283b353db080", "record_id": "flaws_cloudtrail:0000179:3183e29f-a346-449f-8818-283b353db080", "row_index": 179, "timestamp": "2018-10-12T18:17:37Z", "event_type": "DescribeVpcEndpoints", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3183e29f-a346-449f-8818-283b353db080", "eventTime": "2018-10-12T18:17:37Z", "eventName": "DescribeVpcEndpoints", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "errorCode": "Client.DryRunOperation", "errorMessage": "Request would have succeeded, but DryRun flag is set.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeVpcEndpointsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5274ddf-749e-4d6b-85bc-dd9d736f86d4", "record_id": "flaws_cloudtrail:0000180:a5274ddf-749e-4d6b-85bc-dd9d736f86d4", "row_index": 180, "timestamp": "2018-10-12T18:17:38Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5274ddf-749e-4d6b-85bc-dd9d736f86d4", "eventTime": "2018-10-12T18:17:38Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a4a9614-f32b-4a48-824c-fbe9443ae8b2", "record_id": "flaws_cloudtrail:0000181:0a4a9614-f32b-4a48-824c-fbe9443ae8b2", "row_index": 181, "timestamp": "2018-10-12T18:17:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a4a9614-f32b-4a48-824c-fbe9443ae8b2", "eventTime": "2018-10-12T18:17:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "847e0a16-b9eb-4731-b948-d3d39de66a93", "record_id": "flaws_cloudtrail:0000182:847e0a16-b9eb-4731-b948-d3d39de66a93", "row_index": 182, "timestamp": "2018-10-12T18:17:39Z", "event_type": "DescribeCustomerGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 714, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "847e0a16-b9eb-4731-b948-d3d39de66a93", "eventTime": "2018-10-12T18:17:39Z", "eventName": "DescribeCustomerGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"customerGatewaySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4cef66b5-33c5-4bf0-bc2a-04117812fdde", "record_id": "flaws_cloudtrail:0000183:4cef66b5-33c5-4bf0-bc2a-04117812fdde", "row_index": 183, "timestamp": "2018-10-12T18:17:39Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4cef66b5-33c5-4bf0-bc2a-04117812fdde", "eventTime": "2018-10-12T18:17:39Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7653b390-a761-4ae8-9c7c-ef33bf6a3988", "record_id": "flaws_cloudtrail:0000184:7653b390-a761-4ae8-9c7c-ef33bf6a3988", "row_index": 184, "timestamp": "2018-10-12T18:17:40Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7653b390-a761-4ae8-9c7c-ef33bf6a3988", "eventTime": "2018-10-12T18:17:40Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {"MaxResults": 500}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fe30b18-ec48-4196-8236-7db423f35081", "record_id": "flaws_cloudtrail:0000185:0fe30b18-ec48-4196-8236-7db423f35081", "row_index": 185, "timestamp": "2018-10-12T18:17:40Z", "event_type": "DescribeNetworkAcls", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fe30b18-ec48-4196-8236-7db423f35081", "eventTime": "2018-10-12T18:17:40Z", "eventName": "DescribeNetworkAcls", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"networkAclIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20f07bb0-5ad5-4446-95de-a23bf6b08a45", "record_id": "flaws_cloudtrail:0000186:20f07bb0-5ad5-4446-95de-a23bf6b08a45", "row_index": 186, "timestamp": "2018-10-12T18:17:41Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20f07bb0-5ad5-4446-95de-a23bf6b08a45", "eventTime": "2018-10-12T18:17:41Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff9156f1-8900-4e3b-98e3-b11486e1334", "record_id": "flaws_cloudtrail:0000187:ff9156f1-8900-4e3b-98e3-b11486e1334", "row_index": 187, "timestamp": "2018-10-12T18:17:41Z", "event_type": "DescribeRouteTables", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff9156f1-8900-4e3b-98e3-b11486e1334", "eventTime": "2018-10-12T18:17:41Z", "eventName": "DescribeRouteTables", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"routeTableIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70762-2127-4fe6-8180-62ff0817addf", "record_id": "flaws_cloudtrail:0000188:70762-2127-4fe6-8180-62ff0817addf", "row_index": 188, "timestamp": "2018-10-12T18:17:41Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70762-2127-4fe6-8180-62ff0817addf", "eventTime": "2018-10-12T18:17:41Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeNatGatewaysRequest": {"MaxResults": 1000}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c0b5cd1-169e-4fe8-9d48-90db20154e3", "record_id": "flaws_cloudtrail:0000189:8c0b5cd1-169e-4fe8-9d48-90db20154e3", "row_index": 189, "timestamp": "2018-10-12T18:17:42Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c0b5cd1-169e-4fe8-9d48-90db20154e3", "eventTime": "2018-10-12T18:17:42Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "606e99e8-d919-40a6-ba25-6dda0eaa50c2", "record_id": "flaws_cloudtrail:0000190:606e99e8-d919-40a6-ba25-6dda0eaa50c2", "row_index": 190, "timestamp": "2018-10-12T18:17:42Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "606e99e8-d919-40a6-ba25-6dda0eaa50c2", "eventTime": "2018-10-12T18:17:42Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2cce77e-113a-4f77-af7f-e25ca5140958", "record_id": "flaws_cloudtrail:0000191:b2cce77e-113a-4f77-af7f-e25ca5140958", "row_index": 191, "timestamp": "2018-10-12T18:17:43Z", "event_type": "DescribeVpcEndpoints", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2cce77e-113a-4f77-af7f-e25ca5140958", "eventTime": "2018-10-12T18:17:43Z", "eventName": "DescribeVpcEndpoints", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeVpcEndpointsRequest": {"MaxResults": 1000}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6d93229-a3a2-4fe9-8852-cbfe024195f51", "record_id": "flaws_cloudtrail:0000192:6d93229-a3a2-4fe9-8852-cbfe024195f51", "row_index": 192, "timestamp": "2018-10-12T18:18:22Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6d93229-a3a2-4fe9-8852-cbfe024195f51", "eventTime": "2018-10-12T18:18:22Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bdcc7d9c-d063-44cb-be0e-0e41096e79c2", "record_id": "flaws_cloudtrail:0000193:bdcc7d9c-d063-44cb-be0e-0e41096e79c2", "row_index": 193, "timestamp": "2018-10-12T18:18:23Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bdcc7d9c-d063-44cb-be0e-0e41096e79c2", "eventTime": "2018-10-12T18:18:23Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f67a7c76-2a9d-4665-9dec-b8b92a5d0894", "record_id": "flaws_cloudtrail:0000194:f67a7c76-2a9d-4665-9dec-b8b92a5d0894", "row_index": 194, "timestamp": "2018-10-12T18:18:26Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 835, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f67a7c76-2a9d-4665-9dec-b8b92a5d0894", "eventTime": "2018-10-12T18:18:26Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListGroupsForUser on resource: user flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f00ca501-0f8e-4213-86b3-31fdd50dfae2", "record_id": "flaws_cloudtrail:0000195:f00ca501-0f8e-4213-86b3-31fdd50dfae2", "row_index": 195, "timestamp": "2018-10-12T18:18:27Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 849, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f00ca501-0f8e-4213-86b3-31fdd50dfae2", "eventTime": "2018-10-12T18:18:27Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListAttachedUserPolicies on resource: role flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c62098-d264-4559-9105-f99c0bd78bc1", "record_id": "flaws_cloudtrail:0000196:0c62098-d264-4559-9105-f99c0bd78bc1", "row_index": 196, "timestamp": "2018-10-12T18:18:27Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c62098-d264-4559-9105-f99c0bd78bc1", "eventTime": "2018-10-12T18:18:27Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUserPolicies on resource: user flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f9c7323e-08e5-410b-9c93-fe687146af748", "record_id": "flaws_cloudtrail:0000197:f9c7323e-08e5-410b-9c93-fe687146af748", "row_index": 197, "timestamp": "2018-10-12T18:18:55Z", "event_type": "PutUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f9c7323e-08e5-410b-9c93-fe687146af748", "eventTime": "2018-10-12T18:18:55Z", "eventName": "PutUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:PutUserPolicy on resource: user flaws", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5702cb0-4465-4080-9c47-69fc052003", "record_id": "flaws_cloudtrail:0000198:c5702cb0-4465-4080-9c47-69fc052003", "row_index": 198, "timestamp": "2018-10-12T18:21:22Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 647, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5702cb0-4465-4080-9c47-69fc052003", "eventTime": "2018-10-12T18:21:22Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31562a03-ef08-46cf-b202-263482adff51c", "record_id": "flaws_cloudtrail:0000199:31562a03-ef08-46cf-b202-263482adff51c", "row_index": 199, "timestamp": "2018-10-12T18:21:23Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 650, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31562a03-ef08-46cf-b202-263482adff51c", "eventTime": "2018-10-12T18:21:23Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7a84a47-6f20-4d58-ba38-8a907f5bdf37", "record_id": "flaws_cloudtrail:0000200:f7a84a47-6f20-4d58-ba38-8a907f5bdf37", "row_index": 200, "timestamp": "2018-10-12T18:21:24Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7a84a47-6f20-4d58-ba38-8a907f5bdf37", "eventTime": "2018-10-12T18:21:24Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a180995f-ac0d-47a1-b1ef-2e14e6136fcf", "record_id": "flaws_cloudtrail:0000201:4a180995f-ac0d-47a1-b1ef-2e14e6136fcf", "row_index": 201, "timestamp": "2018-10-12T18:21:24Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 650, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a180995f-ac0d-47a1-b1ef-2e14e6136fcf", "eventTime": "2018-10-12T18:21:24Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3cbf3ae0-3667-4954-a985-ed3f7c6d3ca8", "record_id": "flaws_cloudtrail:0000202:3cbf3ae0-3667-4954-a985-ed3f7c6d3ca8", "row_index": 202, "timestamp": "2018-10-12T18:21:26Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 649, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3cbf3ae0-3667-4954-a985-ed3f7c6d3ca8", "eventTime": "2018-10-12T18:21:26Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc03249f-d607-42e4-94d0-1bf41f4f63bb", "record_id": "flaws_cloudtrail:0000203:bc03249f-d607-42e4-94d0-1bf41f4f63bb", "row_index": 203, "timestamp": "2018-10-12T18:21:26Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 645, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc03249f-d607-42e4-94d0-1bf41f4f63bb", "eventTime": "2018-10-12T18:21:26Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72abc940-8d07-4b31-8ecc-7fe2f91bd43a", "record_id": "flaws_cloudtrail:0000204:72abc940-8d07-4b31-8ecc-7fe2f91bd43a", "row_index": 204, "timestamp": "2018-10-12T18:21:27Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 649, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72abc940-8d07-4b31-8ecc-7fe2f91bd43a", "eventTime": "2018-10-12T18:21:27Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdcd3a37-d108-4244-a4cf-c6537833ef4f", "record_id": "flaws_cloudtrail:0000205:fdcd3a37-d108-4244-a4cf-c6537833ef4f", "row_index": 205, "timestamp": "2018-10-12T18:21:29Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 652, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdcd3a37-d108-4244-a4cf-c6537833ef4f", "eventTime": "2018-10-12T18:21:29Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63ae0d98-3cbd-4ec1-be9b-73772cf4a993", "record_id": "flaws_cloudtrail:0000206:63ae0d98-3cbd-4ec1-be9b-73772cf4a993", "row_index": 206, "timestamp": "2018-10-12T18:21:29Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 649, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63ae0d98-3cbd-4ec1-be9b-73772cf4a993", "eventTime": "2018-10-12T18:21:29Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0579ed31-b20b-4afe-8130-dcd1b1644e57", "record_id": "flaws_cloudtrail:0000207:0579ed31-b20b-4afe-8130-dcd1b1644e57", "row_index": 207, "timestamp": "2018-10-12T18:21:30Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 652, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0579ed31-b20b-4afe-8130-dcd1b1644e57", "eventTime": "2018-10-12T18:21:30Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a12e1bbe-8dd0-45db-86f4-09c70aba9c23", "record_id": "flaws_cloudtrail:0000208:a12e1bbe-8dd0-45db-86f4-09c70aba9c23", "row_index": 208, "timestamp": "2018-10-12T18:21:32Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 651, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a12e1bbe-8dd0-45db-86f4-09c70aba9c23", "eventTime": "2018-10-12T18:21:32Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d496a1e0-9269-408d-b26c-7711fff2ff0f", "record_id": "flaws_cloudtrail:0000209:d496a1e0-9269-408d-b26c-7711fff2ff0f", "row_index": 209, "timestamp": "2018-10-12T18:21:32Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 649, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d496a1e0-9269-408d-b26c-7711fff2ff0f", "eventTime": "2018-10-12T18:21:32Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25a24a2c-c83a-4f25-8d4c-bf2160254d09", "record_id": "flaws_cloudtrail:0000210:25a24a2c-c83a-4f25-8d4c-bf2160254d09", "row_index": 210, "timestamp": "2018-10-12T18:21:33Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25a24a2c-c83a-4f25-8d4c-bf2160254d09", "eventTime": "2018-10-12T18:21:33Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e4d0efe-0a2b-4f1f-a712-43b9aeaee60f", "record_id": "flaws_cloudtrail:0000211:7e4d0efe-0a2b-4f1f-a712-43b9aeaee60f", "row_index": 211, "timestamp": "2018-10-12T18:21:34Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 649, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e4d0efe-0a2b-4f1f-a712-43b9aeaee60f", "eventTime": "2018-10-12T18:21:34Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef312ca2-26e9-45e2-8e8e-3774739fafe5", "record_id": "flaws_cloudtrail:0000212:ef312ca2-26e9-45e2-8e8e-3774739fafe5", "row_index": 212, "timestamp": "2018-10-12T18:21:35Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 653, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef312ca2-26e9-45e2-8e8e-3774739fafe5", "eventTime": "2018-10-12T18:21:35Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab6258e0-3162-4d56-bbae-962e812c04bf", "record_id": "flaws_cloudtrail:0000213:ab6258e0-3162-4d56-bbae-962e812c04bf", "row_index": 213, "timestamp": "2018-10-12T18:21:36Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "82.247.92.218", "user_agent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 650, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab6258e0-3162-4d56-bbae-962e812c04bf", "eventTime": "2018-10-12T18:21:36Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "82.247.92.218", "userAgent": "[aws-cli/1.16.32 Python/3.5.3 Linux/4.9.0-7-amd64 botocore/1.12.22]", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f450ef9-2852-4842-b7e7-7772f7db4034", "record_id": "flaws_cloudtrail:0000214:3f450ef9-2852-4842-b7e7-7772f7db4034", "row_index": 214, "timestamp": "2018-10-12T18:23:40Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "[Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 646, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f450ef9-2852-4842-b7e7-7772f7db4034", "eventTime": "2018-10-12T18:23:40Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "[Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a72bc1f-4e18-4e61-bc5d-f53d94402702", "record_id": "flaws_cloudtrail:0000215:7a72bc1f-4e18-4e61-bc5d-f53d94402702", "row_index": 215, "timestamp": "2018-10-12T18:29:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a72bc1f-4e18-4e61-bc5d-f53d94402702", "eventTime": "2018-10-12T18:29:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f954153e-ed6c-48af-abc6-b2749e13854", "record_id": "flaws_cloudtrail:0000216:f954153e-ed6c-48af-abc6-b2749e13854", "row_index": 216, "timestamp": "2018-10-12T18:29:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f954153e-ed6c-48af-abc6-b2749e13854", "eventTime": "2018-10-12T18:29:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f509babd-3f24-4a6d-b76c-83a1192e76e8", "record_id": "flaws_cloudtrail:0000217:f509babd-3f24-4a6d-b76c-83a1192e76e8", "row_index": 217, "timestamp": "2018-10-12T18:29:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f509babd-3f24-4a6d-b76c-83a1192e76e8", "eventTime": "2018-10-12T18:29:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "954108d31-1551-43ed-a110-99af9e9eb03d", "record_id": "flaws_cloudtrail:0000218:954108d31-1551-43ed-a110-99af9e9eb03d", "row_index": 218, "timestamp": "2018-10-12T18:29:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "954108d31-1551-43ed-a110-99af9e9eb03d", "eventTime": "2018-10-12T18:29:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63d78580-9696-4575-b189-c58aff7716b0", "record_id": "flaws_cloudtrail:0000219:63d78580-9696-4575-b189-c58aff7716b0", "row_index": 219, "timestamp": "2018-10-12T18:29:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63d78580-9696-4575-b189-c58aff7716b0", "eventTime": "2018-10-12T18:29:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2affe49-00d2-40a5-83ed-2312ef088402", "record_id": "flaws_cloudtrail:0000220:b2affe49-00d2-40a5-83ed-2312ef088402", "row_index": 220, "timestamp": "2018-10-12T18:29:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2affe49-00d2-40a5-83ed-2312ef088402", "eventTime": "2018-10-12T18:29:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c4811ac-5573-444d-951a-8b6fe014f580", "record_id": "flaws_cloudtrail:0000221:6c4811ac-5573-444d-951a-8b6fe014f580", "row_index": 221, "timestamp": "2018-10-12T18:29:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c4811ac-5573-444d-951a-8b6fe014f580", "eventTime": "2018-10-12T18:29:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e4dedd0-0945-47d5-aaa4-09600e305f45", "record_id": "flaws_cloudtrail:0000222:2e4dedd0-0945-47d5-aaa4-09600e305f45", "row_index": 222, "timestamp": "2018-10-12T18:29:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e4dedd0-0945-47d5-aaa4-09600e305f45", "eventTime": "2018-10-12T18:29:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a33d3412-92f2-4491-b347-c3901a079b50", "record_id": "flaws_cloudtrail:0000223:a33d3412-92f2-4491-b347-c3901a079b50", "row_index": 223, "timestamp": "2018-10-12T18:29:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a33d3412-92f2-4491-b347-c3901a079b50", "eventTime": "2018-10-12T18:29:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb999b82-21ba-4078-9333-dac766168", "record_id": "flaws_cloudtrail:0000224:bb999b82-21ba-4078-9333-dac766168", "row_index": 224, "timestamp": "2018-10-12T18:29:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb999b82-21ba-4078-9333-dac766168", "eventTime": "2018-10-12T18:29:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f17e6fb8-5418-46c8-bd69-72fc241f0b94", "record_id": "flaws_cloudtrail:0000225:f17e6fb8-5418-46c8-bd69-72fc241f0b94", "row_index": 225, "timestamp": "2018-10-12T18:29:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f17e6fb8-5418-46c8-bd69-72fc241f0b94", "eventTime": "2018-10-12T18:29:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd754238f-0174-448b-a592-3f51176b0", "record_id": "flaws_cloudtrail:0000226:bd754238f-0174-448b-a592-3f51176b0", "row_index": 226, "timestamp": "2018-10-12T18:29:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd754238f-0174-448b-a592-3f51176b0", "eventTime": "2018-10-12T18:29:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ce29f42-5988-41ab-998b-901b8d1db444", "record_id": "flaws_cloudtrail:0000227:1ce29f42-5988-41ab-998b-901b8d1db444", "row_index": 227, "timestamp": "2018-10-12T18:29:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ce29f42-5988-41ab-998b-901b8d1db444", "eventTime": "2018-10-12T18:29:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae62f77c-cccf-4fe0-a72a-be7a82407762", "record_id": "flaws_cloudtrail:0000228:ae62f77c-cccf-4fe0-a72a-be7a82407762", "row_index": 228, "timestamp": "2018-10-12T18:30:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae62f77c-cccf-4fe0-a72a-be7a82407762", "eventTime": "2018-10-12T18:30:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf233ab5-2f7c-479c-858b-d621b39f70b3", "record_id": "flaws_cloudtrail:0000229:bf233ab5-2f7c-479c-858b-d621b39f70b3", "row_index": 229, "timestamp": "2018-10-12T18:30:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf233ab5-2f7c-479c-858b-d621b39f70b3", "eventTime": "2018-10-12T18:30:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "effcabf4-0218-4b5d-ade7-d7914fbd8dda", "record_id": "flaws_cloudtrail:0000230:effcabf4-0218-4b5d-ade7-d7914fbd8dda", "row_index": 230, "timestamp": "2018-10-12T18:30:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "effcabf4-0218-4b5d-ade7-d7914fbd8dda", "eventTime": "2018-10-12T18:30:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14aef675-a394-4429-8319-e6e86715e79", "record_id": "flaws_cloudtrail:0000231:14aef675-a394-4429-8319-e6e86715e79", "row_index": 231, "timestamp": "2018-10-12T18:30:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14aef675-a394-4429-8319-e6e86715e79", "eventTime": "2018-10-12T18:30:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eaf9c20c-af2c-429a-9008-9e92e7e68b2b", "record_id": "flaws_cloudtrail:0000232:eaf9c20c-af2c-429a-9008-9e92e7e68b2b", "row_index": 232, "timestamp": "2018-10-12T18:30:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eaf9c20c-af2c-429a-9008-9e92e7e68b2b", "eventTime": "2018-10-12T18:30:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a791456-7943-4244-80db-c053f4485ede", "record_id": "flaws_cloudtrail:0000233:a791456-7943-4244-80db-c053f4485ede", "row_index": 233, "timestamp": "2018-10-12T18:30:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a791456-7943-4244-80db-c053f4485ede", "eventTime": "2018-10-12T18:30:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6bb458a-a81e-4c87-bb3a-c07ac6f383ad", "record_id": "flaws_cloudtrail:0000234:d6bb458a-a81e-4c87-bb3a-c07ac6f383ad", "row_index": 234, "timestamp": "2018-10-12T18:30:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6bb458a-a81e-4c87-bb3a-c07ac6f383ad", "eventTime": "2018-10-12T18:30:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85cb52b6-2fc9-4c2e-b4ca-29ec9258e60f", "record_id": "flaws_cloudtrail:0000235:85cb52b6-2fc9-4c2e-b4ca-29ec9258e60f", "row_index": 235, "timestamp": "2018-10-12T18:30:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85cb52b6-2fc9-4c2e-b4ca-29ec9258e60f", "eventTime": "2018-10-12T18:30:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8e32c56-c815-433b-9d68-66f5b44c8435", "record_id": "flaws_cloudtrail:0000236:e8e32c56-c815-433b-9d68-66f5b44c8435", "row_index": 236, "timestamp": "2018-10-12T18:30:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8e32c56-c815-433b-9d68-66f5b44c8435", "eventTime": "2018-10-12T18:30:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "236963cb5-6012-4f11-b734-1d299ee783b9", "record_id": "flaws_cloudtrail:0000237:236963cb5-6012-4f11-b734-1d299ee783b9", "row_index": 237, "timestamp": "2018-10-12T18:30:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "236963cb5-6012-4f11-b734-1d299ee783b9", "eventTime": "2018-10-12T18:30:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8615cc0f-a4c1-4702-a24f-2ccf3e2fda55", "record_id": "flaws_cloudtrail:0000238:8615cc0f-a4c1-4702-a24f-2ccf3e2fda55", "row_index": 238, "timestamp": "2018-10-12T18:30:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8615cc0f-a4c1-4702-a24f-2ccf3e2fda55", "eventTime": "2018-10-12T18:30:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd0264b0-5c53-4ad7-aa6b-0daa7b44b25e", "record_id": "flaws_cloudtrail:0000239:cd0264b0-5c53-4ad7-aa6b-0daa7b44b25e", "row_index": 239, "timestamp": "2018-10-12T18:30:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd0264b0-5c53-4ad7-aa6b-0daa7b44b25e", "eventTime": "2018-10-12T18:30:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82ce84a2-4a86-43cf-a81a-59f4579567f6", "record_id": "flaws_cloudtrail:0000240:82ce84a2-4a86-43cf-a81a-59f4579567f6", "row_index": 240, "timestamp": "2018-10-12T18:30:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82ce84a2-4a86-43cf-a81a-59f4579567f6", "eventTime": "2018-10-12T18:30:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f820225d-2038-41bc-b709-ddf85f078443d", "record_id": "flaws_cloudtrail:0000241:f820225d-2038-41bc-b709-ddf85f078443d", "row_index": 241, "timestamp": "2018-10-12T18:30:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f820225d-2038-41bc-b709-ddf85f078443d", "eventTime": "2018-10-12T18:30:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16dbc0bf-e9b1-45bc-ae20-9e1a5e25f4fa", "record_id": "flaws_cloudtrail:0000242:16dbc0bf-e9b1-45bc-ae20-9e1a5e25f4fa", "row_index": 242, "timestamp": "2018-10-12T18:30:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16dbc0bf-e9b1-45bc-ae20-9e1a5e25f4fa", "eventTime": "2018-10-12T18:30:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74132c8a-7b8c-4584-aecc-a39d93936255", "record_id": "flaws_cloudtrail:0000243:74132c8a-7b8c-4584-aecc-a39d93936255", "row_index": 243, "timestamp": "2018-10-12T18:30:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74132c8a-7b8c-4584-aecc-a39d93936255", "eventTime": "2018-10-12T18:30:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d2214b2-fac0-4fd4-8a14-07861d", "record_id": "flaws_cloudtrail:0000244:3d2214b2-fac0-4fd4-8a14-07861d", "row_index": 244, "timestamp": "2018-10-12T18:30:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d2214b2-fac0-4fd4-8a14-07861d", "eventTime": "2018-10-12T18:30:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c07b2a90-ebcf-4b92-8b7a-08edce9a3f35", "record_id": "flaws_cloudtrail:0000245:c07b2a90-ebcf-4b92-8b7a-08edce9a3f35", "row_index": 245, "timestamp": "2018-10-12T18:30:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c07b2a90-ebcf-4b92-8b7a-08edce9a3f35", "eventTime": "2018-10-12T18:30:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d271b0c7-5f3e-4387-9f97-ffd2aad3cfe5", "record_id": "flaws_cloudtrail:0000246:d271b0c7-5f3e-4387-9f97-ffd2aad3cfe5", "row_index": 246, "timestamp": "2018-10-12T18:30:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d271b0c7-5f3e-4387-9f97-ffd2aad3cfe5", "eventTime": "2018-10-12T18:30:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2df51a4-dfde-486e-8202-dddbdf467c1a", "record_id": "flaws_cloudtrail:0000247:b2df51a4-dfde-486e-8202-dddbdf467c1a", "row_index": 247, "timestamp": "2018-10-12T18:30:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2df51a4-dfde-486e-8202-dddbdf467c1a", "eventTime": "2018-10-12T18:30:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c4bd146d-7c0b-47bf-aa6b-17f02d3923d0", "record_id": "flaws_cloudtrail:0000248:c4bd146d-7c0b-47bf-aa6b-17f02d3923d0", "row_index": 248, "timestamp": "2018-10-12T18:30:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c4bd146d-7c0b-47bf-aa6b-17f02d3923d0", "eventTime": "2018-10-12T18:30:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "992974a95-a9c0-41f5-aa8b-19d895f57414", "record_id": "flaws_cloudtrail:0000249:992974a95-a9c0-41f5-aa8b-19d895f57414", "row_index": 249, "timestamp": "2018-10-12T18:30:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "992974a95-a9c0-41f5-aa8b-19d895f57414", "eventTime": "2018-10-12T18:30:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff15ea76-cdf2-4e61-a968-ce8dfbfbf01b", "record_id": "flaws_cloudtrail:0000250:ff15ea76-cdf2-4e61-a968-ce8dfbfbf01b", "row_index": 250, "timestamp": "2018-10-12T18:30:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff15ea76-cdf2-4e61-a968-ce8dfbfbf01b", "eventTime": "2018-10-12T18:30:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3959b16c-0188-4940-884e-7908d6314836", "record_id": "flaws_cloudtrail:0000251:3959b16c-0188-4940-884e-7908d6314836", "row_index": 251, "timestamp": "2018-10-12T18:30:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3959b16c-0188-4940-884e-7908d6314836", "eventTime": "2018-10-12T18:30:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2108c30d-99b0-446c-9b17-927b49ee485d", "record_id": "flaws_cloudtrail:0000252:2108c30d-99b0-446c-9b17-927b49ee485d", "row_index": 252, "timestamp": "2018-10-12T18:30:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2108c30d-99b0-446c-9b17-927b49ee485d", "eventTime": "2018-10-12T18:30:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62ce766f-78d4-4650-b098-4a4a5baca11a", "record_id": "flaws_cloudtrail:0000253:62ce766f-78d4-4650-b098-4a4a5baca11a", "row_index": 253, "timestamp": "2018-10-12T18:30:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62ce766f-78d4-4650-b098-4a4a5baca11a", "eventTime": "2018-10-12T18:30:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0d3d981-719e-4c17-b9d5-cd17c27b60e6", "record_id": "flaws_cloudtrail:0000254:c0d3d981-719e-4c17-b9d5-cd17c27b60e6", "row_index": 254, "timestamp": "2018-10-12T18:30:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0d3d981-719e-4c17-b9d5-cd17c27b60e6", "eventTime": "2018-10-12T18:30:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d9eeb38-3e8b-4220-8b7b-36496434d59e", "record_id": "flaws_cloudtrail:0000255:4d9eeb38-3e8b-4220-8b7b-36496434d59e", "row_index": 255, "timestamp": "2018-10-12T18:30:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d9eeb38-3e8b-4220-8b7b-36496434d59e", "eventTime": "2018-10-12T18:30:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a102592d-5489-4453-a409-429983c43986f", "record_id": "flaws_cloudtrail:0000256:8a102592d-5489-4453-a409-429983c43986f", "row_index": 256, "timestamp": "2018-10-12T18:30:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a102592d-5489-4453-a409-429983c43986f", "eventTime": "2018-10-12T18:30:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "561db252-f3af-4155-a7ba-602956720b1c", "record_id": "flaws_cloudtrail:0000257:561db252-f3af-4155-a7ba-602956720b1c", "row_index": 257, "timestamp": "2018-10-12T18:30:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "561db252-f3af-4155-a7ba-602956720b1c", "eventTime": "2018-10-12T18:30:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "568927-9874-49f8-ab9c-b7e3a39c8074", "record_id": "flaws_cloudtrail:0000258:568927-9874-49f8-ab9c-b7e3a39c8074", "row_index": 258, "timestamp": "2018-10-12T18:30:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "568927-9874-49f8-ab9c-b7e3a39c8074", "eventTime": "2018-10-12T18:30:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2b0954c-224a-41ae-aaa9-5b91914ddfdc", "record_id": "flaws_cloudtrail:0000259:d2b0954c-224a-41ae-aaa9-5b91914ddfdc", "row_index": 259, "timestamp": "2018-10-12T18:30:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2b0954c-224a-41ae-aaa9-5b91914ddfdc", "eventTime": "2018-10-12T18:30:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "968d42f8-3f42-45b8-9ae8-2149f8c2384e", "record_id": "flaws_cloudtrail:0000260:968d42f8-3f42-45b8-9ae8-2149f8c2384e", "row_index": 260, "timestamp": "2018-10-12T18:30:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "968d42f8-3f42-45b8-9ae8-2149f8c2384e", "eventTime": "2018-10-12T18:30:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f987489-aa0c-4a52-b1c8-57c0312a4d6e", "record_id": "flaws_cloudtrail:0000261:f987489-aa0c-4a52-b1c8-57c0312a4d6e", "row_index": 261, "timestamp": "2018-10-12T18:30:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f987489-aa0c-4a52-b1c8-57c0312a4d6e", "eventTime": "2018-10-12T18:30:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dbf02cda-118d-43aa-b247-1cf7811ac9ce", "record_id": "flaws_cloudtrail:0000262:dbf02cda-118d-43aa-b247-1cf7811ac9ce", "row_index": 262, "timestamp": "2018-10-12T18:30:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dbf02cda-118d-43aa-b247-1cf7811ac9ce", "eventTime": "2018-10-12T18:30:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc6e8dde-1a93-4664-a611-1b604fc6a77e", "record_id": "flaws_cloudtrail:0000263:bc6e8dde-1a93-4664-a611-1b604fc6a77e", "row_index": 263, "timestamp": "2018-10-12T18:30:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc6e8dde-1a93-4664-a611-1b604fc6a77e", "eventTime": "2018-10-12T18:30:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c7bad8bd-f6c2-42cb-b94c-6940850daa20", "record_id": "flaws_cloudtrail:0000264:c7bad8bd-f6c2-42cb-b94c-6940850daa20", "row_index": 264, "timestamp": "2018-10-12T18:30:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c7bad8bd-f6c2-42cb-b94c-6940850daa20", "eventTime": "2018-10-12T18:30:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4948ee94-e5ad-4b39-993c-25ac887a6303", "record_id": "flaws_cloudtrail:0000265:4948ee94-e5ad-4b39-993c-25ac887a6303", "row_index": 265, "timestamp": "2018-10-12T18:30:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4948ee94-e5ad-4b39-993c-25ac887a6303", "eventTime": "2018-10-12T18:30:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa5d91fa-956f-40ab-8ff7-2d19b3600d78", "record_id": "flaws_cloudtrail:0000266:aa5d91fa-956f-40ab-8ff7-2d19b3600d78", "row_index": 266, "timestamp": "2018-10-12T18:30:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa5d91fa-956f-40ab-8ff7-2d19b3600d78", "eventTime": "2018-10-12T18:30:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86c9b56c-5ce0-497b-a94b-26660a1a285b", "record_id": "flaws_cloudtrail:0000267:86c9b56c-5ce0-497b-a94b-26660a1a285b", "row_index": 267, "timestamp": "2018-10-12T18:30:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86c9b56c-5ce0-497b-a94b-26660a1a285b", "eventTime": "2018-10-12T18:30:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db0bf116-55c7-4c43-a8b4-df8411d6ae90", "record_id": "flaws_cloudtrail:0000268:db0bf116-55c7-4c43-a8b4-df8411d6ae90", "row_index": 268, "timestamp": "2018-10-12T18:30:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db0bf116-55c7-4c43-a8b4-df8411d6ae90", "eventTime": "2018-10-12T18:30:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea595de7-707b-44a7-8fab-d3903a2d37ba", "record_id": "flaws_cloudtrail:0000269:ea595de7-707b-44a7-8fab-d3903a2d37ba", "row_index": 269, "timestamp": "2018-10-12T18:30:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea595de7-707b-44a7-8fab-d3903a2d37ba", "eventTime": "2018-10-12T18:30:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20e993217-0f3a-43bb-8fbb-04750dd39d60", "record_id": "flaws_cloudtrail:0000270:20e993217-0f3a-43bb-8fbb-04750dd39d60", "row_index": 270, "timestamp": "2018-10-12T18:30:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20e993217-0f3a-43bb-8fbb-04750dd39d60", "eventTime": "2018-10-12T18:30:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec7cc06c-cd22-4b6f-861b-7bc5f014090b", "record_id": "flaws_cloudtrail:0000271:ec7cc06c-cd22-4b6f-861b-7bc5f014090b", "row_index": 271, "timestamp": "2018-10-12T18:30:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec7cc06c-cd22-4b6f-861b-7bc5f014090b", "eventTime": "2018-10-12T18:30:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de798078-f727-4adc-8329-0599e590ecf7", "record_id": "flaws_cloudtrail:0000272:de798078-f727-4adc-8329-0599e590ecf7", "row_index": 272, "timestamp": "2018-10-12T18:30:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de798078-f727-4adc-8329-0599e590ecf7", "eventTime": "2018-10-12T18:30:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19e2ec4c-27fd-4049-985b-fe5f7d0da457", "record_id": "flaws_cloudtrail:0000273:19e2ec4c-27fd-4049-985b-fe5f7d0da457", "row_index": 273, "timestamp": "2018-10-12T18:30:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19e2ec4c-27fd-4049-985b-fe5f7d0da457", "eventTime": "2018-10-12T18:30:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "376e1d24-3bc8-4836-8285-7deed23e4bca", "record_id": "flaws_cloudtrail:0000274:376e1d24-3bc8-4836-8285-7deed23e4bca", "row_index": 274, "timestamp": "2018-10-12T18:30:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "376e1d24-3bc8-4836-8285-7deed23e4bca", "eventTime": "2018-10-12T18:30:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e14fa86-6e26-4ca0-b549-fc716ca5bf48", "record_id": "flaws_cloudtrail:0000275:2e14fa86-6e26-4ca0-b549-fc716ca5bf48", "row_index": 275, "timestamp": "2018-10-12T18:30:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e14fa86-6e26-4ca0-b549-fc716ca5bf48", "eventTime": "2018-10-12T18:30:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "003d4f48-2189-48df-9cb2-5c998a8555e2", "record_id": "flaws_cloudtrail:0000276:003d4f48-2189-48df-9cb2-5c998a8555e2", "row_index": 276, "timestamp": "2018-10-12T18:30:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "003d4f48-2189-48df-9cb2-5c998a8555e2", "eventTime": "2018-10-12T18:30:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8aece9ed-182f-42a6-b447-d29b14227c4", "record_id": "flaws_cloudtrail:0000277:8aece9ed-182f-42a6-b447-d29b14227c4", "row_index": 277, "timestamp": "2018-10-12T18:30:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8aece9ed-182f-42a6-b447-d29b14227c4", "eventTime": "2018-10-12T18:30:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3033d037-1718-4690-9271-9c7c45f46ee9", "record_id": "flaws_cloudtrail:0000278:3033d037-1718-4690-9271-9c7c45f46ee9", "row_index": 278, "timestamp": "2018-10-12T18:30:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3033d037-1718-4690-9271-9c7c45f46ee9", "eventTime": "2018-10-12T18:30:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "998d264a-55fd-4a11-b73c-b8f01f961966", "record_id": "flaws_cloudtrail:0000279:998d264a-55fd-4a11-b73c-b8f01f961966", "row_index": 279, "timestamp": "2018-10-12T18:30:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "998d264a-55fd-4a11-b73c-b8f01f961966", "eventTime": "2018-10-12T18:30:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0868b03-0e7d-4fe8-ad70-f2de4ca213669", "record_id": "flaws_cloudtrail:0000280:b0868b03-0e7d-4fe8-ad70-f2de4ca213669", "row_index": 280, "timestamp": "2018-10-12T18:30:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0868b03-0e7d-4fe8-ad70-f2de4ca213669", "eventTime": "2018-10-12T18:30:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7de8595-58ce-4403-8517-942cb46b607e", "record_id": "flaws_cloudtrail:0000281:e7de8595-58ce-4403-8517-942cb46b607e", "row_index": 281, "timestamp": "2018-10-12T18:30:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7de8595-58ce-4403-8517-942cb46b607e", "eventTime": "2018-10-12T18:30:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e0d8253-90fa-4fad-8a66-13e356b3d6a3", "record_id": "flaws_cloudtrail:0000282:1e0d8253-90fa-4fad-8a66-13e356b3d6a3", "row_index": 282, "timestamp": "2018-10-12T18:30:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e0d8253-90fa-4fad-8a66-13e356b3d6a3", "eventTime": "2018-10-12T18:30:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "563f6ae0-84e2-4b5d-add8-d90a48197", "record_id": "flaws_cloudtrail:0000283:563f6ae0-84e2-4b5d-add8-d90a48197", "row_index": 283, "timestamp": "2018-10-12T18:30:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "563f6ae0-84e2-4b5d-add8-d90a48197", "eventTime": "2018-10-12T18:30:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d078074f1-0d17-4e5d-a967-9be73147fcf9", "record_id": "flaws_cloudtrail:0000284:d078074f1-0d17-4e5d-a967-9be73147fcf9", "row_index": 284, "timestamp": "2018-10-12T18:30:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d078074f1-0d17-4e5d-a967-9be73147fcf9", "eventTime": "2018-10-12T18:30:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11da272d-0b45-4aec-a32d-d5dc7a02db67", "record_id": "flaws_cloudtrail:0000285:11da272d-0b45-4aec-a32d-d5dc7a02db67", "row_index": 285, "timestamp": "2018-10-12T18:30:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11da272d-0b45-4aec-a32d-d5dc7a02db67", "eventTime": "2018-10-12T18:30:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "883cd389-a308-48bc-b61a-4f4c814483e0", "record_id": "flaws_cloudtrail:0000286:883cd389-a308-48bc-b61a-4f4c814483e0", "row_index": 286, "timestamp": "2018-10-12T18:30:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "883cd389-a308-48bc-b61a-4f4c814483e0", "eventTime": "2018-10-12T18:30:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "32698b75-26ef-4bb6-a20c-6c517ef70881", "record_id": "flaws_cloudtrail:0000287:32698b75-26ef-4bb6-a20c-6c517ef70881", "row_index": 287, "timestamp": "2018-10-12T18:30:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "32698b75-26ef-4bb6-a20c-6c517ef70881", "eventTime": "2018-10-12T18:30:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c55a7253-5e37-4194-8768-710471fdfb", "record_id": "flaws_cloudtrail:0000288:c55a7253-5e37-4194-8768-710471fdfb", "row_index": 288, "timestamp": "2018-10-12T18:30:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c55a7253-5e37-4194-8768-710471fdfb", "eventTime": "2018-10-12T18:30:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "448b202c-f036-47d2-bbc0-af2c36b0625b", "record_id": "flaws_cloudtrail:0000289:448b202c-f036-47d2-bbc0-af2c36b0625b", "row_index": 289, "timestamp": "2018-10-12T18:30:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "448b202c-f036-47d2-bbc0-af2c36b0625b", "eventTime": "2018-10-12T18:30:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d137868f-5a4a-4665-8748-156184b55effb", "record_id": "flaws_cloudtrail:0000290:d137868f-5a4a-4665-8748-156184b55effb", "row_index": 290, "timestamp": "2018-10-12T18:30:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d137868f-5a4a-4665-8748-156184b55effb", "eventTime": "2018-10-12T18:30:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "975abed2-17ba-4a62-8f3b-80df5428e0a8", "record_id": "flaws_cloudtrail:0000291:975abed2-17ba-4a62-8f3b-80df5428e0a8", "row_index": 291, "timestamp": "2018-10-12T18:30:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "975abed2-17ba-4a62-8f3b-80df5428e0a8", "eventTime": "2018-10-12T18:30:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef45cddd-174c-4999-a699-73d0f59f0acf", "record_id": "flaws_cloudtrail:0000292:ef45cddd-174c-4999-a699-73d0f59f0acf", "row_index": 292, "timestamp": "2018-10-12T18:30:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef45cddd-174c-4999-a699-73d0f59f0acf", "eventTime": "2018-10-12T18:30:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db01fa28-de25-4848-bf31-0197b19474fe", "record_id": "flaws_cloudtrail:0000293:db01fa28-de25-4848-bf31-0197b19474fe", "row_index": 293, "timestamp": "2018-10-12T18:30:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db01fa28-de25-4848-bf31-0197b19474fe", "eventTime": "2018-10-12T18:30:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ca03abf-6e98-4ff5-9e22-236797f2cca3a", "record_id": "flaws_cloudtrail:0000294:3ca03abf-6e98-4ff5-9e22-236797f2cca3a", "row_index": 294, "timestamp": "2018-10-12T18:30:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ca03abf-6e98-4ff5-9e22-236797f2cca3a", "eventTime": "2018-10-12T18:30:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08285d55-f402-42e7-99a1-1f06f94134", "record_id": "flaws_cloudtrail:0000295:08285d55-f402-42e7-99a1-1f06f94134", "row_index": 295, "timestamp": "2018-10-12T18:30:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08285d55-f402-42e7-99a1-1f06f94134", "eventTime": "2018-10-12T18:30:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f0fd76d-a6ad-4d60-9e83-e2b6bfd6f412", "record_id": "flaws_cloudtrail:0000296:0f0fd76d-a6ad-4d60-9e83-e2b6bfd6f412", "row_index": 296, "timestamp": "2018-10-12T18:30:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f0fd76d-a6ad-4d60-9e83-e2b6bfd6f412", "eventTime": "2018-10-12T18:30:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1a282d7-c006-4d12-89d6-0357d84abeec", "record_id": "flaws_cloudtrail:0000297:a1a282d7-c006-4d12-89d6-0357d84abeec", "row_index": 297, "timestamp": "2018-10-12T18:30:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1a282d7-c006-4d12-89d6-0357d84abeec", "eventTime": "2018-10-12T18:30:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4bd08f19-208a-4aca-b824-ebb63ff2b8bd", "record_id": "flaws_cloudtrail:0000298:4bd08f19-208a-4aca-b824-ebb63ff2b8bd", "row_index": 298, "timestamp": "2018-10-12T18:30:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4bd08f19-208a-4aca-b824-ebb63ff2b8bd", "eventTime": "2018-10-12T18:30:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc7c4d10-8c23-493e-94a3-b8b7ad18e028", "record_id": "flaws_cloudtrail:0000299:cc7c4d10-8c23-493e-94a3-b8b7ad18e028", "row_index": 299, "timestamp": "2018-10-12T18:30:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc7c4d10-8c23-493e-94a3-b8b7ad18e028", "eventTime": "2018-10-12T18:30:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de81cba5-3a4d-4d70-972d-780920acb73c", "record_id": "flaws_cloudtrail:0000300:de81cba5-3a4d-4d70-972d-780920acb73c", "row_index": 300, "timestamp": "2018-10-12T18:30:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de81cba5-3a4d-4d70-972d-780920acb73c", "eventTime": "2018-10-12T18:30:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41a5f0ae-6723-4c83-8369-04484a008ed0", "record_id": "flaws_cloudtrail:0000301:41a5f0ae-6723-4c83-8369-04484a008ed0", "row_index": 301, "timestamp": "2018-10-12T18:30:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41a5f0ae-6723-4c83-8369-04484a008ed0", "eventTime": "2018-10-12T18:30:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe3cfa71-f83c-4df1-867c-bec29ba83a2d", "record_id": "flaws_cloudtrail:0000302:fe3cfa71-f83c-4df1-867c-bec29ba83a2d", "row_index": 302, "timestamp": "2018-10-12T18:30:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe3cfa71-f83c-4df1-867c-bec29ba83a2d", "eventTime": "2018-10-12T18:30:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5552f01c-d61e-4968-8995-881a859269b4", "record_id": "flaws_cloudtrail:0000303:5552f01c-d61e-4968-8995-881a859269b4", "row_index": 303, "timestamp": "2018-10-12T18:30:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5552f01c-d61e-4968-8995-881a859269b4", "eventTime": "2018-10-12T18:30:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9f105246-d8c1-4bb5-bae6-df55382", "record_id": "flaws_cloudtrail:0000304:d9f105246-d8c1-4bb5-bae6-df55382", "row_index": 304, "timestamp": "2018-10-12T18:30:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9f105246-d8c1-4bb5-bae6-df55382", "eventTime": "2018-10-12T18:30:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c469dbd7-6249-47bc-852a-d925b1c06931", "record_id": "flaws_cloudtrail:0000305:c469dbd7-6249-47bc-852a-d925b1c06931", "row_index": 305, "timestamp": "2018-10-12T18:30:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c469dbd7-6249-47bc-852a-d925b1c06931", "eventTime": "2018-10-12T18:30:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3b36d4bd-f718-4026-9a15-46546f3fa06", "record_id": "flaws_cloudtrail:0000306:3b36d4bd-f718-4026-9a15-46546f3fa06", "row_index": 306, "timestamp": "2018-10-12T18:30:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3b36d4bd-f718-4026-9a15-46546f3fa06", "eventTime": "2018-10-12T18:30:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b39fe986-5d68-49a0-8a60-5fe0e9d973693", "record_id": "flaws_cloudtrail:0000307:b39fe986-5d68-49a0-8a60-5fe0e9d973693", "row_index": 307, "timestamp": "2018-10-12T18:30:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b39fe986-5d68-49a0-8a60-5fe0e9d973693", "eventTime": "2018-10-12T18:30:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "399f5e04-ed35-45b3-b960-5b327237d1e21", "record_id": "flaws_cloudtrail:0000308:399f5e04-ed35-45b3-b960-5b327237d1e21", "row_index": 308, "timestamp": "2018-10-12T18:30:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "399f5e04-ed35-45b3-b960-5b327237d1e21", "eventTime": "2018-10-12T18:30:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd252992-75cb-4963-b398-3a20698", "record_id": "flaws_cloudtrail:0000309:dd252992-75cb-4963-b398-3a20698", "row_index": 309, "timestamp": "2018-10-12T18:30:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd252992-75cb-4963-b398-3a20698", "eventTime": "2018-10-12T18:30:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "820188b3-f71f-4abf-8314-66de09bbd1ae", "record_id": "flaws_cloudtrail:0000310:820188b3-f71f-4abf-8314-66de09bbd1ae", "row_index": 310, "timestamp": "2018-10-12T18:30:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "820188b3-f71f-4abf-8314-66de09bbd1ae", "eventTime": "2018-10-12T18:30:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb4f85f5-e10e-445d-8558-7d52949aba5", "record_id": "flaws_cloudtrail:0000311:fb4f85f5-e10e-445d-8558-7d52949aba5", "row_index": 311, "timestamp": "2018-10-12T18:30:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb4f85f5-e10e-445d-8558-7d52949aba5", "eventTime": "2018-10-12T18:30:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d1d5454-6799-4d45-bd40-500dad8c7b58", "record_id": "flaws_cloudtrail:0000312:9d1d5454-6799-4d45-bd40-500dad8c7b58", "row_index": 312, "timestamp": "2018-10-12T18:30:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d1d5454-6799-4d45-bd40-500dad8c7b58", "eventTime": "2018-10-12T18:30:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "982e6cf0-b0f8-48a5-b985-daecc37552bc", "record_id": "flaws_cloudtrail:0000313:982e6cf0-b0f8-48a5-b985-daecc37552bc", "row_index": 313, "timestamp": "2018-10-12T18:30:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "982e6cf0-b0f8-48a5-b985-daecc37552bc", "eventTime": "2018-10-12T18:30:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f84f688f-3c0d-43b1-8d34-dafcadabb9b4", "record_id": "flaws_cloudtrail:0000314:f84f688f-3c0d-43b1-8d34-dafcadabb9b4", "row_index": 314, "timestamp": "2018-10-12T18:30:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f84f688f-3c0d-43b1-8d34-dafcadabb9b4", "eventTime": "2018-10-12T18:30:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7705e73d-5930-4aae-b403-bc55e88bc57d", "record_id": "flaws_cloudtrail:0000315:7705e73d-5930-4aae-b403-bc55e88bc57d", "row_index": 315, "timestamp": "2018-10-12T18:30:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7705e73d-5930-4aae-b403-bc55e88bc57d", "eventTime": "2018-10-12T18:30:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d6f718f-5131-48c8-9ef8-de45c52d0d34", "record_id": "flaws_cloudtrail:0000316:3d6f718f-5131-48c8-9ef8-de45c52d0d34", "row_index": 316, "timestamp": "2018-10-12T18:30:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d6f718f-5131-48c8-9ef8-de45c52d0d34", "eventTime": "2018-10-12T18:30:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09f68097-89e4-41b9-bb6c-5dde18f128ca", "record_id": "flaws_cloudtrail:0000317:09f68097-89e4-41b9-bb6c-5dde18f128ca", "row_index": 317, "timestamp": "2018-10-12T18:30:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09f68097-89e4-41b9-bb6c-5dde18f128ca", "eventTime": "2018-10-12T18:30:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92a908dc-9fc4-4b20-920c-62d640565f42", "record_id": "flaws_cloudtrail:0000318:92a908dc-9fc4-4b20-920c-62d640565f42", "row_index": 318, "timestamp": "2018-10-12T18:30:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92a908dc-9fc4-4b20-920c-62d640565f42", "eventTime": "2018-10-12T18:30:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8802b128-d759-4efe-86ce-e836096261c9", "record_id": "flaws_cloudtrail:0000319:8802b128-d759-4efe-86ce-e836096261c9", "row_index": 319, "timestamp": "2018-10-12T18:30:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8802b128-d759-4efe-86ce-e836096261c9", "eventTime": "2018-10-12T18:30:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "749eafe4-588b-451c-b0d2-9b83231f2e", "record_id": "flaws_cloudtrail:0000320:749eafe4-588b-451c-b0d2-9b83231f2e", "row_index": 320, "timestamp": "2018-10-12T18:30:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "749eafe4-588b-451c-b0d2-9b83231f2e", "eventTime": "2018-10-12T18:30:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a96c38c-cd73-4a7e-9c36-d947604b4854a", "record_id": "flaws_cloudtrail:0000321:5a96c38c-cd73-4a7e-9c36-d947604b4854a", "row_index": 321, "timestamp": "2018-10-12T18:30:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a96c38c-cd73-4a7e-9c36-d947604b4854a", "eventTime": "2018-10-12T18:30:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f30e26c-25fe-4c9a-9a84-75ef4fda974d", "record_id": "flaws_cloudtrail:0000322:7f30e26c-25fe-4c9a-9a84-75ef4fda974d", "row_index": 322, "timestamp": "2018-10-12T18:30:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f30e26c-25fe-4c9a-9a84-75ef4fda974d", "eventTime": "2018-10-12T18:30:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e1c98ea-9a4b-45cb-8bdd-fc0134b4433a", "record_id": "flaws_cloudtrail:0000323:4e1c98ea-9a4b-45cb-8bdd-fc0134b4433a", "row_index": 323, "timestamp": "2018-10-12T18:30:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e1c98ea-9a4b-45cb-8bdd-fc0134b4433a", "eventTime": "2018-10-12T18:30:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc9a42da-4df7-4506-8187-a697b29a919e", "record_id": "flaws_cloudtrail:0000324:fc9a42da-4df7-4506-8187-a697b29a919e", "row_index": 324, "timestamp": "2018-10-12T18:30:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc9a42da-4df7-4506-8187-a697b29a919e", "eventTime": "2018-10-12T18:30:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0145d03-31f7-4eba-a4de-e848ca194336", "record_id": "flaws_cloudtrail:0000325:b0145d03-31f7-4eba-a4de-e848ca194336", "row_index": 325, "timestamp": "2018-10-12T18:30:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0145d03-31f7-4eba-a4de-e848ca194336", "eventTime": "2018-10-12T18:30:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "101777-acb0-4015-be2a-3e8711bb65ef", "record_id": "flaws_cloudtrail:0000326:101777-acb0-4015-be2a-3e8711bb65ef", "row_index": 326, "timestamp": "2018-10-12T18:30:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "101777-acb0-4015-be2a-3e8711bb65ef", "eventTime": "2018-10-12T18:30:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cc0c77d-7a95-4614-b6b2-f06202f0c0e1", "record_id": "flaws_cloudtrail:0000327:5cc0c77d-7a95-4614-b6b2-f06202f0c0e1", "row_index": 327, "timestamp": "2018-10-12T18:30:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cc0c77d-7a95-4614-b6b2-f06202f0c0e1", "eventTime": "2018-10-12T18:30:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6eb6b52e-bbc7-4b2e-81df-623b370e9cdd", "record_id": "flaws_cloudtrail:0000328:6eb6b52e-bbc7-4b2e-81df-623b370e9cdd", "row_index": 328, "timestamp": "2018-10-12T18:30:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6eb6b52e-bbc7-4b2e-81df-623b370e9cdd", "eventTime": "2018-10-12T18:30:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c81ec9b-52de-4e4c-bffd-90596687d693", "record_id": "flaws_cloudtrail:0000329:1c81ec9b-52de-4e4c-bffd-90596687d693", "row_index": 329, "timestamp": "2018-10-12T18:30:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c81ec9b-52de-4e4c-bffd-90596687d693", "eventTime": "2018-10-12T18:30:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6c0cf4d-897d-48fd-961d-5ff88ea68814", "record_id": "flaws_cloudtrail:0000330:c6c0cf4d-897d-48fd-961d-5ff88ea68814", "row_index": 330, "timestamp": "2018-10-12T18:30:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6c0cf4d-897d-48fd-961d-5ff88ea68814", "eventTime": "2018-10-12T18:30:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ca32055-d83e-4652-b635-2a96fe396ad8", "record_id": "flaws_cloudtrail:0000331:3ca32055-d83e-4652-b635-2a96fe396ad8", "row_index": 331, "timestamp": "2018-10-12T18:30:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ca32055-d83e-4652-b635-2a96fe396ad8", "eventTime": "2018-10-12T18:30:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "163299b29-ddc6-41c7-88c5-9cbc770441e", "record_id": "flaws_cloudtrail:0000332:163299b29-ddc6-41c7-88c5-9cbc770441e", "row_index": 332, "timestamp": "2018-10-12T18:30:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "163299b29-ddc6-41c7-88c5-9cbc770441e", "eventTime": "2018-10-12T18:30:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37f759165-527c-4136-8597-fe12d893f110", "record_id": "flaws_cloudtrail:0000333:37f759165-527c-4136-8597-fe12d893f110", "row_index": 333, "timestamp": "2018-10-12T18:30:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37f759165-527c-4136-8597-fe12d893f110", "eventTime": "2018-10-12T18:30:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13ed6c99-3c6e-49be-a705-3d62f982eef0", "record_id": "flaws_cloudtrail:0000334:13ed6c99-3c6e-49be-a705-3d62f982eef0", "row_index": 334, "timestamp": "2018-10-12T18:30:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13ed6c99-3c6e-49be-a705-3d62f982eef0", "eventTime": "2018-10-12T18:30:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f034938-fdbd-4e24-9ca5-cac5f45388f4", "record_id": "flaws_cloudtrail:0000335:0f034938-fdbd-4e24-9ca5-cac5f45388f4", "row_index": 335, "timestamp": "2018-10-12T18:30:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f034938-fdbd-4e24-9ca5-cac5f45388f4", "eventTime": "2018-10-12T18:30:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ea5457c-ec22-4c42-8b65-35879b0ff24", "record_id": "flaws_cloudtrail:0000336:4ea5457c-ec22-4c42-8b65-35879b0ff24", "row_index": 336, "timestamp": "2018-10-12T18:30:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ea5457c-ec22-4c42-8b65-35879b0ff24", "eventTime": "2018-10-12T18:30:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aabb1805-dc76-456e-8c25-1fd25abb2e3e", "record_id": "flaws_cloudtrail:0000337:aabb1805-dc76-456e-8c25-1fd25abb2e3e", "row_index": 337, "timestamp": "2018-10-12T18:30:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aabb1805-dc76-456e-8c25-1fd25abb2e3e", "eventTime": "2018-10-12T18:30:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bdd482a-bf6a-4222-b4c6-628da3011f8f", "record_id": "flaws_cloudtrail:0000338:9bdd482a-bf6a-4222-b4c6-628da3011f8f", "row_index": 338, "timestamp": "2018-10-12T18:30:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bdd482a-bf6a-4222-b4c6-628da3011f8f", "eventTime": "2018-10-12T18:30:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09939a92-95c1-46a1-b1bb-ec945691178f", "record_id": "flaws_cloudtrail:0000339:09939a92-95c1-46a1-b1bb-ec945691178f", "row_index": 339, "timestamp": "2018-10-12T18:30:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09939a92-95c1-46a1-b1bb-ec945691178f", "eventTime": "2018-10-12T18:30:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "246cc6d5-39d4-4ed0-b4a5-d6e117a8ad9e", "record_id": "flaws_cloudtrail:0000340:246cc6d5-39d4-4ed0-b4a5-d6e117a8ad9e", "row_index": 340, "timestamp": "2018-10-12T18:30:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "246cc6d5-39d4-4ed0-b4a5-d6e117a8ad9e", "eventTime": "2018-10-12T18:30:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "912d5139-6546-4195-82e7-c1108f3889c6", "record_id": "flaws_cloudtrail:0000341:912d5139-6546-4195-82e7-c1108f3889c6", "row_index": 341, "timestamp": "2018-10-12T18:30:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "912d5139-6546-4195-82e7-c1108f3889c6", "eventTime": "2018-10-12T18:30:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9dc6cdf-c166-410a-a513-7f18c3bf778d", "record_id": "flaws_cloudtrail:0000342:b9dc6cdf-c166-410a-a513-7f18c3bf778d", "row_index": 342, "timestamp": "2018-10-12T18:30:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9dc6cdf-c166-410a-a513-7f18c3bf778d", "eventTime": "2018-10-12T18:30:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5aa6db63-b9a6-4423-9086-39093dccff91", "record_id": "flaws_cloudtrail:0000343:5aa6db63-b9a6-4423-9086-39093dccff91", "row_index": 343, "timestamp": "2018-10-12T18:30:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5aa6db63-b9a6-4423-9086-39093dccff91", "eventTime": "2018-10-12T18:30:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f239447-b521-4719-b631-0e75b8bab3fc", "record_id": "flaws_cloudtrail:0000344:5f239447-b521-4719-b631-0e75b8bab3fc", "row_index": 344, "timestamp": "2018-10-12T18:30:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f239447-b521-4719-b631-0e75b8bab3fc", "eventTime": "2018-10-12T18:30:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6053d7df-4946-438a-9dfc-4699ebb37440", "record_id": "flaws_cloudtrail:0000345:6053d7df-4946-438a-9dfc-4699ebb37440", "row_index": 345, "timestamp": "2018-10-12T18:30:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6053d7df-4946-438a-9dfc-4699ebb37440", "eventTime": "2018-10-12T18:30:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ecc45f66-a70d-4aa1-a42c-f2251742994b", "record_id": "flaws_cloudtrail:0000346:ecc45f66-a70d-4aa1-a42c-f2251742994b", "row_index": 346, "timestamp": "2018-10-12T18:30:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ecc45f66-a70d-4aa1-a42c-f2251742994b", "eventTime": "2018-10-12T18:30:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0735c70e-2ee4-4e2c-a033-4b7d942d6692", "record_id": "flaws_cloudtrail:0000347:0735c70e-2ee4-4e2c-a033-4b7d942d6692", "row_index": 347, "timestamp": "2018-10-12T18:30:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0735c70e-2ee4-4e2c-a033-4b7d942d6692", "eventTime": "2018-10-12T18:30:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71e85c4c-3196-4f8c-981d-4bc14fcab989", "record_id": "flaws_cloudtrail:0000348:71e85c4c-3196-4f8c-981d-4bc14fcab989", "row_index": 348, "timestamp": "2018-10-12T18:30:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71e85c4c-3196-4f8c-981d-4bc14fcab989", "eventTime": "2018-10-12T18:30:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c3aed337-ad94-49a2-898e-201a5d7589a5", "record_id": "flaws_cloudtrail:0000349:c3aed337-ad94-49a2-898e-201a5d7589a5", "row_index": 349, "timestamp": "2018-10-12T18:30:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c3aed337-ad94-49a2-898e-201a5d7589a5", "eventTime": "2018-10-12T18:30:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5fdfbc9e-463f-42a4-a015-a751bf44d6bf", "record_id": "flaws_cloudtrail:0000350:5fdfbc9e-463f-42a4-a015-a751bf44d6bf", "row_index": 350, "timestamp": "2018-10-12T18:30:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5fdfbc9e-463f-42a4-a015-a751bf44d6bf", "eventTime": "2018-10-12T18:30:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba93da7f-5672-46e1-97c8-ca5326a9b470", "record_id": "flaws_cloudtrail:0000351:ba93da7f-5672-46e1-97c8-ca5326a9b470", "row_index": 351, "timestamp": "2018-10-12T18:30:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba93da7f-5672-46e1-97c8-ca5326a9b470", "eventTime": "2018-10-12T18:30:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f68d4914-6115-4158-875f-991903528ed8", "record_id": "flaws_cloudtrail:0000352:f68d4914-6115-4158-875f-991903528ed8", "row_index": 352, "timestamp": "2018-10-12T18:30:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f68d4914-6115-4158-875f-991903528ed8", "eventTime": "2018-10-12T18:30:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51252bd-1628-402c-8823-b0467c498f27", "record_id": "flaws_cloudtrail:0000353:51252bd-1628-402c-8823-b0467c498f27", "row_index": 353, "timestamp": "2018-10-12T18:30:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51252bd-1628-402c-8823-b0467c498f27", "eventTime": "2018-10-12T18:30:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a3a9bc3-075f-4311-8ecb-7a431dadc731", "record_id": "flaws_cloudtrail:0000354:2a3a9bc3-075f-4311-8ecb-7a431dadc731", "row_index": 354, "timestamp": "2018-10-12T18:30:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a3a9bc3-075f-4311-8ecb-7a431dadc731", "eventTime": "2018-10-12T18:30:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef939847-1dfb-4d68-8d95-989d391fe6f2", "record_id": "flaws_cloudtrail:0000355:ef939847-1dfb-4d68-8d95-989d391fe6f2", "row_index": 355, "timestamp": "2018-10-12T18:30:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef939847-1dfb-4d68-8d95-989d391fe6f2", "eventTime": "2018-10-12T18:30:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c4fc40dd-f419-427b-ac51-7000dccd7ad2", "record_id": "flaws_cloudtrail:0000356:c4fc40dd-f419-427b-ac51-7000dccd7ad2", "row_index": 356, "timestamp": "2018-10-12T18:30:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c4fc40dd-f419-427b-ac51-7000dccd7ad2", "eventTime": "2018-10-12T18:30:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "120d5265-8eb7-4b08-81e8-ceb30c0920b5", "record_id": "flaws_cloudtrail:0000357:120d5265-8eb7-4b08-81e8-ceb30c0920b5", "row_index": 357, "timestamp": "2018-10-12T18:30:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "120d5265-8eb7-4b08-81e8-ceb30c0920b5", "eventTime": "2018-10-12T18:30:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a185ab31-4aa7-4299-90ef-d57ca6f582a4", "record_id": "flaws_cloudtrail:0000358:a185ab31-4aa7-4299-90ef-d57ca6f582a4", "row_index": 358, "timestamp": "2018-10-12T18:30:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a185ab31-4aa7-4299-90ef-d57ca6f582a4", "eventTime": "2018-10-12T18:30:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d699992d-9c3b-4096-b808-308d0238edda", "record_id": "flaws_cloudtrail:0000359:9d699992d-9c3b-4096-b808-308d0238edda", "row_index": 359, "timestamp": "2018-10-12T18:30:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d699992d-9c3b-4096-b808-308d0238edda", "eventTime": "2018-10-12T18:30:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dacf7235-063d-466d-9c11-1193a0d06f5c", "record_id": "flaws_cloudtrail:0000360:dacf7235-063d-466d-9c11-1193a0d06f5c", "row_index": 360, "timestamp": "2018-10-12T18:30:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dacf7235-063d-466d-9c11-1193a0d06f5c", "eventTime": "2018-10-12T18:30:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f616243fd-0402-4688-8e9b-335b6a749069", "record_id": "flaws_cloudtrail:0000361:f616243fd-0402-4688-8e9b-335b6a749069", "row_index": 361, "timestamp": "2018-10-12T18:30:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f616243fd-0402-4688-8e9b-335b6a749069", "eventTime": "2018-10-12T18:30:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c1088df3-118e-46b0-ad09-d064f7901a8c", "record_id": "flaws_cloudtrail:0000362:c1088df3-118e-46b0-ad09-d064f7901a8c", "row_index": 362, "timestamp": "2018-10-12T18:30:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c1088df3-118e-46b0-ad09-d064f7901a8c", "eventTime": "2018-10-12T18:30:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "109a20e0-2450-42d7-a3a6-6c97ad9c83d1", "record_id": "flaws_cloudtrail:0000363:109a20e0-2450-42d7-a3a6-6c97ad9c83d1", "row_index": 363, "timestamp": "2018-10-12T18:30:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "109a20e0-2450-42d7-a3a6-6c97ad9c83d1", "eventTime": "2018-10-12T18:30:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2802f8e2-dc0b-4241-a7d7-8fd975460fbe", "record_id": "flaws_cloudtrail:0000364:2802f8e2-dc0b-4241-a7d7-8fd975460fbe", "row_index": 364, "timestamp": "2018-10-12T18:30:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2802f8e2-dc0b-4241-a7d7-8fd975460fbe", "eventTime": "2018-10-12T18:30:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc47a53f-dfdf-4ef0-9eb9-2aeb3d7304a5", "record_id": "flaws_cloudtrail:0000365:bc47a53f-dfdf-4ef0-9eb9-2aeb3d7304a5", "row_index": 365, "timestamp": "2018-10-12T18:30:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc47a53f-dfdf-4ef0-9eb9-2aeb3d7304a5", "eventTime": "2018-10-12T18:30:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d861362d-e552-4d69-b78b-050398f6013c", "record_id": "flaws_cloudtrail:0000366:d861362d-e552-4d69-b78b-050398f6013c", "row_index": 366, "timestamp": "2018-10-12T18:30:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d861362d-e552-4d69-b78b-050398f6013c", "eventTime": "2018-10-12T18:30:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1575baf8-b189-4941-87aa-e6e1e1cd8ff6", "record_id": "flaws_cloudtrail:0000367:1575baf8-b189-4941-87aa-e6e1e1cd8ff6", "row_index": 367, "timestamp": "2018-10-12T18:30:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1575baf8-b189-4941-87aa-e6e1e1cd8ff6", "eventTime": "2018-10-12T18:30:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7656dff1-ec76-4a64-87da-e2ca21ecbba8", "record_id": "flaws_cloudtrail:0000368:7656dff1-ec76-4a64-87da-e2ca21ecbba8", "row_index": 368, "timestamp": "2018-10-12T18:30:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7656dff1-ec76-4a64-87da-e2ca21ecbba8", "eventTime": "2018-10-12T18:30:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "527021-8bda-4f28-8f66-ebe91985ad1", "record_id": "flaws_cloudtrail:0000369:527021-8bda-4f28-8f66-ebe91985ad1", "row_index": 369, "timestamp": "2018-10-12T18:30:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "527021-8bda-4f28-8f66-ebe91985ad1", "eventTime": "2018-10-12T18:30:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f1db7e8-3c1f-4067-a3a8-96b6f7056eff", "record_id": "flaws_cloudtrail:0000370:5f1db7e8-3c1f-4067-a3a8-96b6f7056eff", "row_index": 370, "timestamp": "2018-10-12T18:30:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f1db7e8-3c1f-4067-a3a8-96b6f7056eff", "eventTime": "2018-10-12T18:30:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b18b61e-2948-49ab-8b4c-711685d5ffd1", "record_id": "flaws_cloudtrail:0000371:8b18b61e-2948-49ab-8b4c-711685d5ffd1", "row_index": 371, "timestamp": "2018-10-12T18:30:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b18b61e-2948-49ab-8b4c-711685d5ffd1", "eventTime": "2018-10-12T18:30:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8353ff89-bb90-4370-8739-3724e043dd4f", "record_id": "flaws_cloudtrail:0000372:8353ff89-bb90-4370-8739-3724e043dd4f", "row_index": 372, "timestamp": "2018-10-12T18:30:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8353ff89-bb90-4370-8739-3724e043dd4f", "eventTime": "2018-10-12T18:30:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7cd180064-fc32-4e8b-87d3-836aa2ca5ad8", "record_id": "flaws_cloudtrail:0000373:7cd180064-fc32-4e8b-87d3-836aa2ca5ad8", "row_index": 373, "timestamp": "2018-10-12T18:30:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7cd180064-fc32-4e8b-87d3-836aa2ca5ad8", "eventTime": "2018-10-12T18:30:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8b690432-2a51-47fb-be11-ba718565", "record_id": "flaws_cloudtrail:0000374:e8b690432-2a51-47fb-be11-ba718565", "row_index": 374, "timestamp": "2018-10-12T18:30:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8b690432-2a51-47fb-be11-ba718565", "eventTime": "2018-10-12T18:30:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "252375-f930-479f-8a83-59201ea7300a", "record_id": "flaws_cloudtrail:0000375:252375-f930-479f-8a83-59201ea7300a", "row_index": 375, "timestamp": "2018-10-12T18:30:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "252375-f930-479f-8a83-59201ea7300a", "eventTime": "2018-10-12T18:30:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27fb8bb4-b780-4641-aad5-5582dbcce598", "record_id": "flaws_cloudtrail:0000376:27fb8bb4-b780-4641-aad5-5582dbcce598", "row_index": 376, "timestamp": "2018-10-12T18:30:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27fb8bb4-b780-4641-aad5-5582dbcce598", "eventTime": "2018-10-12T18:30:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2bfd1487-b6b3-4baf-8b43-131a27889d2", "record_id": "flaws_cloudtrail:0000377:2bfd1487-b6b3-4baf-8b43-131a27889d2", "row_index": 377, "timestamp": "2018-10-12T18:30:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2bfd1487-b6b3-4baf-8b43-131a27889d2", "eventTime": "2018-10-12T18:30:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6cc4293-0b21-4400-97c6-394d00eb7778", "record_id": "flaws_cloudtrail:0000378:b6cc4293-0b21-4400-97c6-394d00eb7778", "row_index": 378, "timestamp": "2018-10-12T18:30:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6cc4293-0b21-4400-97c6-394d00eb7778", "eventTime": "2018-10-12T18:30:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51d4c561-6101-4f4d-b788-1a9c8a05abc4", "record_id": "flaws_cloudtrail:0000379:51d4c561-6101-4f4d-b788-1a9c8a05abc4", "row_index": 379, "timestamp": "2018-10-12T18:30:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51d4c561-6101-4f4d-b788-1a9c8a05abc4", "eventTime": "2018-10-12T18:30:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0882c98-32b2-4ba3-bea6-b5536bb3a617", "record_id": "flaws_cloudtrail:0000380:c0882c98-32b2-4ba3-bea6-b5536bb3a617", "row_index": 380, "timestamp": "2018-10-12T18:30:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0882c98-32b2-4ba3-bea6-b5536bb3a617", "eventTime": "2018-10-12T18:30:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30d1e2af-0514-4195-a157-15e6f25db3a2", "record_id": "flaws_cloudtrail:0000381:30d1e2af-0514-4195-a157-15e6f25db3a2", "row_index": 381, "timestamp": "2018-10-12T18:30:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30d1e2af-0514-4195-a157-15e6f25db3a2", "eventTime": "2018-10-12T18:30:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b45b4ead-0c47-43f9-ab92-35313e7a15c", "record_id": "flaws_cloudtrail:0000382:b45b4ead-0c47-43f9-ab92-35313e7a15c", "row_index": 382, "timestamp": "2018-10-12T18:30:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b45b4ead-0c47-43f9-ab92-35313e7a15c", "eventTime": "2018-10-12T18:30:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad86953-a7ac-429e-97f0-482d801974fff", "record_id": "flaws_cloudtrail:0000383:ad86953-a7ac-429e-97f0-482d801974fff", "row_index": 383, "timestamp": "2018-10-12T18:30:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad86953-a7ac-429e-97f0-482d801974fff", "eventTime": "2018-10-12T18:30:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "32e1c3d8-da4e-41d3-a3bd-bef84f1e6893", "record_id": "flaws_cloudtrail:0000384:32e1c3d8-da4e-41d3-a3bd-bef84f1e6893", "row_index": 384, "timestamp": "2018-10-12T18:30:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "32e1c3d8-da4e-41d3-a3bd-bef84f1e6893", "eventTime": "2018-10-12T18:30:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a50353c-9776-4ed4-b3d8-026c9f161c9e", "record_id": "flaws_cloudtrail:0000385:a50353c-9776-4ed4-b3d8-026c9f161c9e", "row_index": 385, "timestamp": "2018-10-12T18:30:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a50353c-9776-4ed4-b3d8-026c9f161c9e", "eventTime": "2018-10-12T18:30:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79c81430-9f0d-427e-92e6-f27b4e76487", "record_id": "flaws_cloudtrail:0000386:79c81430-9f0d-427e-92e6-f27b4e76487", "row_index": 386, "timestamp": "2018-10-12T18:30:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79c81430-9f0d-427e-92e6-f27b4e76487", "eventTime": "2018-10-12T18:30:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96ab609a-2f89-4f6d-bf6d-dde21daa512a", "record_id": "flaws_cloudtrail:0000387:96ab609a-2f89-4f6d-bf6d-dde21daa512a", "row_index": 387, "timestamp": "2018-10-12T18:30:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96ab609a-2f89-4f6d-bf6d-dde21daa512a", "eventTime": "2018-10-12T18:30:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91d1ec18-5238-41f6-a2bc-6ceb7cac19a9", "record_id": "flaws_cloudtrail:0000388:91d1ec18-5238-41f6-a2bc-6ceb7cac19a9", "row_index": 388, "timestamp": "2018-10-12T18:30:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91d1ec18-5238-41f6-a2bc-6ceb7cac19a9", "eventTime": "2018-10-12T18:30:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a0ef708-98ad-4c0e-9f6b-acc8147b0df1", "record_id": "flaws_cloudtrail:0000389:6a0ef708-98ad-4c0e-9f6b-acc8147b0df1", "row_index": 389, "timestamp": "2018-10-12T18:30:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a0ef708-98ad-4c0e-9f6b-acc8147b0df1", "eventTime": "2018-10-12T18:30:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3660d00-2366-4020-b768-2b0e871dae30", "record_id": "flaws_cloudtrail:0000390:e3660d00-2366-4020-b768-2b0e871dae30", "row_index": 390, "timestamp": "2018-10-12T18:30:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3660d00-2366-4020-b768-2b0e871dae30", "eventTime": "2018-10-12T18:30:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "003a79cd-b28c-43d5-9dad-70c2eb7dfb7f", "record_id": "flaws_cloudtrail:0000391:003a79cd-b28c-43d5-9dad-70c2eb7dfb7f", "row_index": 391, "timestamp": "2018-10-12T18:30:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "003a79cd-b28c-43d5-9dad-70c2eb7dfb7f", "eventTime": "2018-10-12T18:30:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00cf6596-69e8-4765-b349-4018f5f7f6b4", "record_id": "flaws_cloudtrail:0000392:00cf6596-69e8-4765-b349-4018f5f7f6b4", "row_index": 392, "timestamp": "2018-10-12T18:30:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00cf6596-69e8-4765-b349-4018f5f7f6b4", "eventTime": "2018-10-12T18:30:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27c7be5b-43f2-42f4-a74b-f13b9b12f1db", "record_id": "flaws_cloudtrail:0000393:27c7be5b-43f2-42f4-a74b-f13b9b12f1db", "row_index": 393, "timestamp": "2018-10-12T18:30:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27c7be5b-43f2-42f4-a74b-f13b9b12f1db", "eventTime": "2018-10-12T18:30:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2309f797-b710-4c7b-ae8d-98a9f01a137b", "record_id": "flaws_cloudtrail:0000394:2309f797-b710-4c7b-ae8d-98a9f01a137b", "row_index": 394, "timestamp": "2018-10-12T18:30:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2309f797-b710-4c7b-ae8d-98a9f01a137b", "eventTime": "2018-10-12T18:30:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46b032738-394f-43b4-8e26-1aa79ea876340", "record_id": "flaws_cloudtrail:0000395:46b032738-394f-43b4-8e26-1aa79ea876340", "row_index": 395, "timestamp": "2018-10-12T18:30:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46b032738-394f-43b4-8e26-1aa79ea876340", "eventTime": "2018-10-12T18:30:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17bc3456-e119-4ef7-a354-cf91240dcc84", "record_id": "flaws_cloudtrail:0000396:17bc3456-e119-4ef7-a354-cf91240dcc84", "row_index": 396, "timestamp": "2018-10-12T18:30:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17bc3456-e119-4ef7-a354-cf91240dcc84", "eventTime": "2018-10-12T18:30:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c949f7ab-b800-4f79-9642-9570ff744aa0", "record_id": "flaws_cloudtrail:0000397:c949f7ab-b800-4f79-9642-9570ff744aa0", "row_index": 397, "timestamp": "2018-10-12T18:30:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c949f7ab-b800-4f79-9642-9570ff744aa0", "eventTime": "2018-10-12T18:30:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7cb7112b-b704-406c-aefa-fef7dcbec0e1", "record_id": "flaws_cloudtrail:0000398:7cb7112b-b704-406c-aefa-fef7dcbec0e1", "row_index": 398, "timestamp": "2018-10-12T18:30:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7cb7112b-b704-406c-aefa-fef7dcbec0e1", "eventTime": "2018-10-12T18:30:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9e15fd6-e3b6-4989-8084-ace1ad71d420", "record_id": "flaws_cloudtrail:0000399:c9e15fd6-e3b6-4989-8084-ace1ad71d420", "row_index": 399, "timestamp": "2018-10-12T18:30:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9e15fd6-e3b6-4989-8084-ace1ad71d420", "eventTime": "2018-10-12T18:30:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74f7b21e-7642-4ce8-bb42-beb97b11104e", "record_id": "flaws_cloudtrail:0000400:74f7b21e-7642-4ce8-bb42-beb97b11104e", "row_index": 400, "timestamp": "2018-10-12T18:30:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74f7b21e-7642-4ce8-bb42-beb97b11104e", "eventTime": "2018-10-12T18:30:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14491-b82d-43e7-8586-8a7dd7396dbf", "record_id": "flaws_cloudtrail:0000401:14491-b82d-43e7-8586-8a7dd7396dbf", "row_index": 401, "timestamp": "2018-10-12T18:30:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14491-b82d-43e7-8586-8a7dd7396dbf", "eventTime": "2018-10-12T18:30:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53fcccac-cf69-44dd-94e7-b2f01c63d6ff", "record_id": "flaws_cloudtrail:0000402:53fcccac-cf69-44dd-94e7-b2f01c63d6ff", "row_index": 402, "timestamp": "2018-10-12T18:30:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53fcccac-cf69-44dd-94e7-b2f01c63d6ff", "eventTime": "2018-10-12T18:30:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb6112d6-4852-49f3-a928-310e6da2a074", "record_id": "flaws_cloudtrail:0000403:bb6112d6-4852-49f3-a928-310e6da2a074", "row_index": 403, "timestamp": "2018-10-12T18:30:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb6112d6-4852-49f3-a928-310e6da2a074", "eventTime": "2018-10-12T18:30:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c12164-513c-44c2-9bbc-28de1a04fa2d", "record_id": "flaws_cloudtrail:0000404:4c12164-513c-44c2-9bbc-28de1a04fa2d", "row_index": 404, "timestamp": "2018-10-12T18:30:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c12164-513c-44c2-9bbc-28de1a04fa2d", "eventTime": "2018-10-12T18:30:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "371b4a6c-37a4-4a16-be14-8fd7414ad921", "record_id": "flaws_cloudtrail:0000405:371b4a6c-37a4-4a16-be14-8fd7414ad921", "row_index": 405, "timestamp": "2018-10-12T18:30:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "371b4a6c-37a4-4a16-be14-8fd7414ad921", "eventTime": "2018-10-12T18:30:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c794c4be-afbd-485e-a686-8b14749c1635", "record_id": "flaws_cloudtrail:0000406:c794c4be-afbd-485e-a686-8b14749c1635", "row_index": 406, "timestamp": "2018-10-12T18:30:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c794c4be-afbd-485e-a686-8b14749c1635", "eventTime": "2018-10-12T18:30:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "daee4a47-56ab-400d-8e71-6595fa2b7a5d", "record_id": "flaws_cloudtrail:0000407:daee4a47-56ab-400d-8e71-6595fa2b7a5d", "row_index": 407, "timestamp": "2018-10-12T18:30:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "daee4a47-56ab-400d-8e71-6595fa2b7a5d", "eventTime": "2018-10-12T18:30:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56df613c-37fc-4763-ba49-cd01ad9aa6b5", "record_id": "flaws_cloudtrail:0000408:56df613c-37fc-4763-ba49-cd01ad9aa6b5", "row_index": 408, "timestamp": "2018-10-12T18:30:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56df613c-37fc-4763-ba49-cd01ad9aa6b5", "eventTime": "2018-10-12T18:30:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "347b78b7-0115-41bb-b0b6-625f902602e3d", "record_id": "flaws_cloudtrail:0000409:347b78b7-0115-41bb-b0b6-625f902602e3d", "row_index": 409, "timestamp": "2018-10-12T18:30:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "347b78b7-0115-41bb-b0b6-625f902602e3d", "eventTime": "2018-10-12T18:30:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da299053-cd17-4400-8d62-a7a97965b906", "record_id": "flaws_cloudtrail:0000410:da299053-cd17-4400-8d62-a7a97965b906", "row_index": 410, "timestamp": "2018-10-12T18:30:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da299053-cd17-4400-8d62-a7a97965b906", "eventTime": "2018-10-12T18:30:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0df0a867-3207-4c06-8d3c-0e819355772e", "record_id": "flaws_cloudtrail:0000411:0df0a867-3207-4c06-8d3c-0e819355772e", "row_index": 411, "timestamp": "2018-10-12T18:30:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0df0a867-3207-4c06-8d3c-0e819355772e", "eventTime": "2018-10-12T18:30:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da4ae5c5-28a4-4511-b365-f85952aa274d", "record_id": "flaws_cloudtrail:0000412:da4ae5c5-28a4-4511-b365-f85952aa274d", "row_index": 412, "timestamp": "2018-10-12T18:30:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da4ae5c5-28a4-4511-b365-f85952aa274d", "eventTime": "2018-10-12T18:30:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85ad2d5a-5e14-4810-94e6-b764cd2522a5", "record_id": "flaws_cloudtrail:0000413:85ad2d5a-5e14-4810-94e6-b764cd2522a5", "row_index": 413, "timestamp": "2018-10-12T18:30:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85ad2d5a-5e14-4810-94e6-b764cd2522a5", "eventTime": "2018-10-12T18:30:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eea0a0e7-2d88-4476-91a0-ecf4134bc48d", "record_id": "flaws_cloudtrail:0000414:eea0a0e7-2d88-4476-91a0-ecf4134bc48d", "row_index": 414, "timestamp": "2018-10-12T18:30:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eea0a0e7-2d88-4476-91a0-ecf4134bc48d", "eventTime": "2018-10-12T18:30:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c7a85dd-d5d0-4c57-b600-aee57d92a467", "record_id": "flaws_cloudtrail:0000415:6c7a85dd-d5d0-4c57-b600-aee57d92a467", "row_index": 415, "timestamp": "2018-10-12T18:30:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c7a85dd-d5d0-4c57-b600-aee57d92a467", "eventTime": "2018-10-12T18:30:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "796c6b9d-e739-42cc-b6b8-694b0a431437", "record_id": "flaws_cloudtrail:0000416:796c6b9d-e739-42cc-b6b8-694b0a431437", "row_index": 416, "timestamp": "2018-10-12T18:30:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "796c6b9d-e739-42cc-b6b8-694b0a431437", "eventTime": "2018-10-12T18:30:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53debffb-efcf-4570-9b7b-9ff47acc8d7f", "record_id": "flaws_cloudtrail:0000417:53debffb-efcf-4570-9b7b-9ff47acc8d7f", "row_index": 417, "timestamp": "2018-10-12T18:30:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53debffb-efcf-4570-9b7b-9ff47acc8d7f", "eventTime": "2018-10-12T18:30:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d28750c5-a472-44d6-a095-df19ed186c43", "record_id": "flaws_cloudtrail:0000418:d28750c5-a472-44d6-a095-df19ed186c43", "row_index": 418, "timestamp": "2018-10-12T18:30:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d28750c5-a472-44d6-a095-df19ed186c43", "eventTime": "2018-10-12T18:30:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d195fb7-13a6-4e59-8092-de6438b527ce", "record_id": "flaws_cloudtrail:0000419:4d195fb7-13a6-4e59-8092-de6438b527ce", "row_index": 419, "timestamp": "2018-10-12T18:30:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d195fb7-13a6-4e59-8092-de6438b527ce", "eventTime": "2018-10-12T18:30:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d445e13a-fd97-490d-b3a9-4823bbe6c29b", "record_id": "flaws_cloudtrail:0000420:d445e13a-fd97-490d-b3a9-4823bbe6c29b", "row_index": 420, "timestamp": "2018-10-12T18:30:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d445e13a-fd97-490d-b3a9-4823bbe6c29b", "eventTime": "2018-10-12T18:30:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0eb11ead-b0ff-40ab-8395-ab2dc0f572a5", "record_id": "flaws_cloudtrail:0000421:0eb11ead-b0ff-40ab-8395-ab2dc0f572a5", "row_index": 421, "timestamp": "2018-10-12T18:30:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0eb11ead-b0ff-40ab-8395-ab2dc0f572a5", "eventTime": "2018-10-12T18:30:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5eb22da5-f6b4-40bd-b61c-973a6f7e04ec", "record_id": "flaws_cloudtrail:0000422:5eb22da5-f6b4-40bd-b61c-973a6f7e04ec", "row_index": 422, "timestamp": "2018-10-12T18:30:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5eb22da5-f6b4-40bd-b61c-973a6f7e04ec", "eventTime": "2018-10-12T18:30:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c254292-967c-4771-a171-9f9d2b70dcc7", "record_id": "flaws_cloudtrail:0000423:2c254292-967c-4771-a171-9f9d2b70dcc7", "row_index": 423, "timestamp": "2018-10-12T18:30:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c254292-967c-4771-a171-9f9d2b70dcc7", "eventTime": "2018-10-12T18:30:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d46caa8a-a842-4348-b1a1-db91b7332b72", "record_id": "flaws_cloudtrail:0000424:d46caa8a-a842-4348-b1a1-db91b7332b72", "row_index": 424, "timestamp": "2018-10-12T18:30:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d46caa8a-a842-4348-b1a1-db91b7332b72", "eventTime": "2018-10-12T18:30:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "84f4b7b8-5279-4e57-9a4f-d83b994f0d2a", "record_id": "flaws_cloudtrail:0000425:84f4b7b8-5279-4e57-9a4f-d83b994f0d2a", "row_index": 425, "timestamp": "2018-10-12T18:30:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "84f4b7b8-5279-4e57-9a4f-d83b994f0d2a", "eventTime": "2018-10-12T18:30:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "108a8714-6379-45c9-ba8e-e7a2c11019b0", "record_id": "flaws_cloudtrail:0000426:108a8714-6379-45c9-ba8e-e7a2c11019b0", "row_index": 426, "timestamp": "2018-10-12T18:30:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "108a8714-6379-45c9-ba8e-e7a2c11019b0", "eventTime": "2018-10-12T18:30:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a179b97c-aba6-4a0f-be62-5c29bbe844e6", "record_id": "flaws_cloudtrail:0000427:a179b97c-aba6-4a0f-be62-5c29bbe844e6", "row_index": 427, "timestamp": "2018-10-12T18:30:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a179b97c-aba6-4a0f-be62-5c29bbe844e6", "eventTime": "2018-10-12T18:30:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a34ccc94-52bf-42f1-9a70-4f377e2c8465", "record_id": "flaws_cloudtrail:0000428:a34ccc94-52bf-42f1-9a70-4f377e2c8465", "row_index": 428, "timestamp": "2018-10-12T18:30:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a34ccc94-52bf-42f1-9a70-4f377e2c8465", "eventTime": "2018-10-12T18:30:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73b65a4c-e8af-426d-ba62-d54422", "record_id": "flaws_cloudtrail:0000429:73b65a4c-e8af-426d-ba62-d54422", "row_index": 429, "timestamp": "2018-10-12T18:30:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73b65a4c-e8af-426d-ba62-d54422", "eventTime": "2018-10-12T18:30:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffdc0a7d-ca78-44fc-81f1-ac13dd5547a6", "record_id": "flaws_cloudtrail:0000430:ffdc0a7d-ca78-44fc-81f1-ac13dd5547a6", "row_index": 430, "timestamp": "2018-10-12T18:30:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffdc0a7d-ca78-44fc-81f1-ac13dd5547a6", "eventTime": "2018-10-12T18:30:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17f164cd-8d1b-4e63-84a6-5cc94f5b4a3f", "record_id": "flaws_cloudtrail:0000431:17f164cd-8d1b-4e63-84a6-5cc94f5b4a3f", "row_index": 431, "timestamp": "2018-10-12T18:30:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17f164cd-8d1b-4e63-84a6-5cc94f5b4a3f", "eventTime": "2018-10-12T18:30:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c699c770-adf9-43f5-b379-55523f64d623", "record_id": "flaws_cloudtrail:0000432:c699c770-adf9-43f5-b379-55523f64d623", "row_index": 432, "timestamp": "2018-10-12T18:30:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c699c770-adf9-43f5-b379-55523f64d623", "eventTime": "2018-10-12T18:30:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a62aebe8-8b05-4b02-9b69-9358ee2cc6ae", "record_id": "flaws_cloudtrail:0000433:a62aebe8-8b05-4b02-9b69-9358ee2cc6ae", "row_index": 433, "timestamp": "2018-10-12T18:30:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a62aebe8-8b05-4b02-9b69-9358ee2cc6ae", "eventTime": "2018-10-12T18:30:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce0fa8be-71f7-4f07-84d4-90ba7b10c0f4", "record_id": "flaws_cloudtrail:0000434:ce0fa8be-71f7-4f07-84d4-90ba7b10c0f4", "row_index": 434, "timestamp": "2018-10-12T18:30:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce0fa8be-71f7-4f07-84d4-90ba7b10c0f4", "eventTime": "2018-10-12T18:30:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d884180-f1f4-4983-b58a-44e21f5bcdb9", "record_id": "flaws_cloudtrail:0000435:0d884180-f1f4-4983-b58a-44e21f5bcdb9", "row_index": 435, "timestamp": "2018-10-12T18:30:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d884180-f1f4-4983-b58a-44e21f5bcdb9", "eventTime": "2018-10-12T18:30:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8e144c0-0adc-4521-893f-74d0a6a72067", "record_id": "flaws_cloudtrail:0000436:c8e144c0-0adc-4521-893f-74d0a6a72067", "row_index": 436, "timestamp": "2018-10-12T18:30:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8e144c0-0adc-4521-893f-74d0a6a72067", "eventTime": "2018-10-12T18:30:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ef42c35-9c80-4d91-95e5-87293c4a48", "record_id": "flaws_cloudtrail:0000437:6ef42c35-9c80-4d91-95e5-87293c4a48", "row_index": 437, "timestamp": "2018-10-12T18:30:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ef42c35-9c80-4d91-95e5-87293c4a48", "eventTime": "2018-10-12T18:30:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7dd447b-b62b-4659-8013-1b234ee0abbd", "record_id": "flaws_cloudtrail:0000438:d7dd447b-b62b-4659-8013-1b234ee0abbd", "row_index": 438, "timestamp": "2018-10-12T18:30:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7dd447b-b62b-4659-8013-1b234ee0abbd", "eventTime": "2018-10-12T18:30:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "770248a1c-35f7-4443-8642-23d3e3aac452", "record_id": "flaws_cloudtrail:0000439:770248a1c-35f7-4443-8642-23d3e3aac452", "row_index": 439, "timestamp": "2018-10-12T18:30:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "770248a1c-35f7-4443-8642-23d3e3aac452", "eventTime": "2018-10-12T18:30:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29f18bdf-b10b-46ee-9aff-5b4bee73ffc0", "record_id": "flaws_cloudtrail:0000440:29f18bdf-b10b-46ee-9aff-5b4bee73ffc0", "row_index": 440, "timestamp": "2018-10-12T18:30:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29f18bdf-b10b-46ee-9aff-5b4bee73ffc0", "eventTime": "2018-10-12T18:30:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77b436ac-6df2-42e9-bf2a-f388e1134406", "record_id": "flaws_cloudtrail:0000441:77b436ac-6df2-42e9-bf2a-f388e1134406", "row_index": 441, "timestamp": "2018-10-12T18:30:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77b436ac-6df2-42e9-bf2a-f388e1134406", "eventTime": "2018-10-12T18:30:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1895cd8c-6273-4ccd-bfb8-9a62f4698a8e", "record_id": "flaws_cloudtrail:0000442:1895cd8c-6273-4ccd-bfb8-9a62f4698a8e", "row_index": 442, "timestamp": "2018-10-12T18:30:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1895cd8c-6273-4ccd-bfb8-9a62f4698a8e", "eventTime": "2018-10-12T18:30:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a35b17a2-125b-4df0-ac9e-4879b11ad64b", "record_id": "flaws_cloudtrail:0000443:a35b17a2-125b-4df0-ac9e-4879b11ad64b", "row_index": 443, "timestamp": "2018-10-12T18:30:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a35b17a2-125b-4df0-ac9e-4879b11ad64b", "eventTime": "2018-10-12T18:30:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eef7eebb-717e-4cb2-ab62-0c2afc967bc2", "record_id": "flaws_cloudtrail:0000444:eef7eebb-717e-4cb2-ab62-0c2afc967bc2", "row_index": 444, "timestamp": "2018-10-12T18:30:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eef7eebb-717e-4cb2-ab62-0c2afc967bc2", "eventTime": "2018-10-12T18:30:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5ae015d-f429-4b00-970a-e9ac20325e43", "record_id": "flaws_cloudtrail:0000445:a5ae015d-f429-4b00-970a-e9ac20325e43", "row_index": 445, "timestamp": "2018-10-12T18:30:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5ae015d-f429-4b00-970a-e9ac20325e43", "eventTime": "2018-10-12T18:30:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aba06cb5-c476-48cc-aa03-07db69a328b9", "record_id": "flaws_cloudtrail:0000446:aba06cb5-c476-48cc-aa03-07db69a328b9", "row_index": 446, "timestamp": "2018-10-12T18:30:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aba06cb5-c476-48cc-aa03-07db69a328b9", "eventTime": "2018-10-12T18:30:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f972f24a-95be-4bc5-88eb-6bb39e272634", "record_id": "flaws_cloudtrail:0000447:f972f24a-95be-4bc5-88eb-6bb39e272634", "row_index": 447, "timestamp": "2018-10-12T18:30:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f972f24a-95be-4bc5-88eb-6bb39e272634", "eventTime": "2018-10-12T18:30:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36fd8a8a-ea39-4570-b0e0-0620fa8bf0b4", "record_id": "flaws_cloudtrail:0000448:36fd8a8a-ea39-4570-b0e0-0620fa8bf0b4", "row_index": 448, "timestamp": "2018-10-12T18:30:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36fd8a8a-ea39-4570-b0e0-0620fa8bf0b4", "eventTime": "2018-10-12T18:30:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd7f961d-bc5d-4ddc-b894-137527fbb5", "record_id": "flaws_cloudtrail:0000449:cd7f961d-bc5d-4ddc-b894-137527fbb5", "row_index": 449, "timestamp": "2018-10-12T18:30:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd7f961d-bc5d-4ddc-b894-137527fbb5", "eventTime": "2018-10-12T18:30:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "45be77ad-289b-47d2-a356-b983788df9c", "record_id": "flaws_cloudtrail:0000450:45be77ad-289b-47d2-a356-b983788df9c", "row_index": 450, "timestamp": "2018-10-12T18:30:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "45be77ad-289b-47d2-a356-b983788df9c", "eventTime": "2018-10-12T18:30:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ab61ae3-8371-49a5-bd87-e01c269d456c", "record_id": "flaws_cloudtrail:0000451:1ab61ae3-8371-49a5-bd87-e01c269d456c", "row_index": 451, "timestamp": "2018-10-12T18:30:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ab61ae3-8371-49a5-bd87-e01c269d456c", "eventTime": "2018-10-12T18:30:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc2281d0-d52c-4d7a-b736-f4ee078c743e", "record_id": "flaws_cloudtrail:0000452:dc2281d0-d52c-4d7a-b736-f4ee078c743e", "row_index": 452, "timestamp": "2018-10-12T18:30:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc2281d0-d52c-4d7a-b736-f4ee078c743e", "eventTime": "2018-10-12T18:30:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "523c53d6-cb02-4e89-bb8c-edd1564248cf", "record_id": "flaws_cloudtrail:0000453:523c53d6-cb02-4e89-bb8c-edd1564248cf", "row_index": 453, "timestamp": "2018-10-12T18:30:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "523c53d6-cb02-4e89-bb8c-edd1564248cf", "eventTime": "2018-10-12T18:30:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a67cf874-3667-46bf-a8c5-a2c293c2c372", "record_id": "flaws_cloudtrail:0000454:a67cf874-3667-46bf-a8c5-a2c293c2c372", "row_index": 454, "timestamp": "2018-10-12T18:30:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a67cf874-3667-46bf-a8c5-a2c293c2c372", "eventTime": "2018-10-12T18:30:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "961a12d3-b134-4135-a4de-c0baf38feff0", "record_id": "flaws_cloudtrail:0000455:961a12d3-b134-4135-a4de-c0baf38feff0", "row_index": 455, "timestamp": "2018-10-12T18:30:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "961a12d3-b134-4135-a4de-c0baf38feff0", "eventTime": "2018-10-12T18:30:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f58d5e5-e523-4f2d-9e6b-5bb813a3ad56", "record_id": "flaws_cloudtrail:0000456:9f58d5e5-e523-4f2d-9e6b-5bb813a3ad56", "row_index": 456, "timestamp": "2018-10-12T18:30:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f58d5e5-e523-4f2d-9e6b-5bb813a3ad56", "eventTime": "2018-10-12T18:30:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c69fb01-5880-47f4-9947-210e0d875a43", "record_id": "flaws_cloudtrail:0000457:4c69fb01-5880-47f4-9947-210e0d875a43", "row_index": 457, "timestamp": "2018-10-12T18:30:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c69fb01-5880-47f4-9947-210e0d875a43", "eventTime": "2018-10-12T18:30:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d52d83d9-dc37-4f28-8f51-992b83b26a22", "record_id": "flaws_cloudtrail:0000458:d52d83d9-dc37-4f28-8f51-992b83b26a22", "row_index": 458, "timestamp": "2018-10-12T18:30:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d52d83d9-dc37-4f28-8f51-992b83b26a22", "eventTime": "2018-10-12T18:30:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "459471c27-e6c7-421d-afe2-13b4723c11eb", "record_id": "flaws_cloudtrail:0000459:459471c27-e6c7-421d-afe2-13b4723c11eb", "row_index": 459, "timestamp": "2018-10-12T18:30:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "459471c27-e6c7-421d-afe2-13b4723c11eb", "eventTime": "2018-10-12T18:30:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43b2adcb-cc2d-44b8-8774-570392c5df7", "record_id": "flaws_cloudtrail:0000460:43b2adcb-cc2d-44b8-8774-570392c5df7", "row_index": 460, "timestamp": "2018-10-12T18:30:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43b2adcb-cc2d-44b8-8774-570392c5df7", "eventTime": "2018-10-12T18:30:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd7db27b-a54d-4cf6-a377-6fe23ec482bf", "record_id": "flaws_cloudtrail:0000461:fd7db27b-a54d-4cf6-a377-6fe23ec482bf", "row_index": 461, "timestamp": "2018-10-12T18:30:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd7db27b-a54d-4cf6-a377-6fe23ec482bf", "eventTime": "2018-10-12T18:30:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a4eb652-2187-44c1-a0ff-7389db8a871b", "record_id": "flaws_cloudtrail:0000462:5a4eb652-2187-44c1-a0ff-7389db8a871b", "row_index": 462, "timestamp": "2018-10-12T18:31:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a4eb652-2187-44c1-a0ff-7389db8a871b", "eventTime": "2018-10-12T18:31:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2b5c44a-e7a4-4609-b9fb-aba921eafa4d", "record_id": "flaws_cloudtrail:0000463:f2b5c44a-e7a4-4609-b9fb-aba921eafa4d", "row_index": 463, "timestamp": "2018-10-12T18:31:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2b5c44a-e7a4-4609-b9fb-aba921eafa4d", "eventTime": "2018-10-12T18:31:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c7bf713f-73ba-4519-bb37-c65351aa0d49", "record_id": "flaws_cloudtrail:0000464:c7bf713f-73ba-4519-bb37-c65351aa0d49", "row_index": 464, "timestamp": "2018-10-12T18:31:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c7bf713f-73ba-4519-bb37-c65351aa0d49", "eventTime": "2018-10-12T18:31:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e94b9ff-5ea7-429a-98c1-8fb258688a86", "record_id": "flaws_cloudtrail:0000465:6e94b9ff-5ea7-429a-98c1-8fb258688a86", "row_index": 465, "timestamp": "2018-10-12T18:31:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e94b9ff-5ea7-429a-98c1-8fb258688a86", "eventTime": "2018-10-12T18:31:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "138e32ef-66d2-423c-9f62-5685d0656a4e", "record_id": "flaws_cloudtrail:0000466:138e32ef-66d2-423c-9f62-5685d0656a4e", "row_index": 466, "timestamp": "2018-10-12T18:31:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "138e32ef-66d2-423c-9f62-5685d0656a4e", "eventTime": "2018-10-12T18:31:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "caf70b60-470b-4704-a0bb-bde0cc6c6611", "record_id": "flaws_cloudtrail:0000467:caf70b60-470b-4704-a0bb-bde0cc6c6611", "row_index": 467, "timestamp": "2018-10-12T18:31:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "caf70b60-470b-4704-a0bb-bde0cc6c6611", "eventTime": "2018-10-12T18:31:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01b631ae-6579-4add-a538-97c133c321c3", "record_id": "flaws_cloudtrail:0000468:01b631ae-6579-4add-a538-97c133c321c3", "row_index": 468, "timestamp": "2018-10-12T18:31:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01b631ae-6579-4add-a538-97c133c321c3", "eventTime": "2018-10-12T18:31:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ec5116e-0541-4110-a1c4-a117e7d9882e", "record_id": "flaws_cloudtrail:0000469:3ec5116e-0541-4110-a1c4-a117e7d9882e", "row_index": 469, "timestamp": "2018-10-12T18:31:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ec5116e-0541-4110-a1c4-a117e7d9882e", "eventTime": "2018-10-12T18:31:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65c4d090-f74c-4a14-9ee9-c3cff3342f43", "record_id": "flaws_cloudtrail:0000470:65c4d090-f74c-4a14-9ee9-c3cff3342f43", "row_index": 470, "timestamp": "2018-10-12T18:31:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65c4d090-f74c-4a14-9ee9-c3cff3342f43", "eventTime": "2018-10-12T18:31:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0480a26-65a0-42a1-b03a-412c86c21928", "record_id": "flaws_cloudtrail:0000471:b0480a26-65a0-42a1-b03a-412c86c21928", "row_index": 471, "timestamp": "2018-10-12T18:31:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0480a26-65a0-42a1-b03a-412c86c21928", "eventTime": "2018-10-12T18:31:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed12713-54e1-430a-a280-0cda78c7702e", "record_id": "flaws_cloudtrail:0000472:ed12713-54e1-430a-a280-0cda78c7702e", "row_index": 472, "timestamp": "2018-10-12T18:31:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed12713-54e1-430a-a280-0cda78c7702e", "eventTime": "2018-10-12T18:31:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30e4f9a2-f236-460c-bb3c-0e233219c833", "record_id": "flaws_cloudtrail:0000473:30e4f9a2-f236-460c-bb3c-0e233219c833", "row_index": 473, "timestamp": "2018-10-12T18:31:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30e4f9a2-f236-460c-bb3c-0e233219c833", "eventTime": "2018-10-12T18:31:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ddb226a3-ed99-47a4-b58b-2768597d17b9", "record_id": "flaws_cloudtrail:0000474:ddb226a3-ed99-47a4-b58b-2768597d17b9", "row_index": 474, "timestamp": "2018-10-12T18:31:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ddb226a3-ed99-47a4-b58b-2768597d17b9", "eventTime": "2018-10-12T18:31:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d49db0c-3738-4d30-80cb-c0fbe953cc7c", "record_id": "flaws_cloudtrail:0000475:1d49db0c-3738-4d30-80cb-c0fbe953cc7c", "row_index": 475, "timestamp": "2018-10-12T18:31:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d49db0c-3738-4d30-80cb-c0fbe953cc7c", "eventTime": "2018-10-12T18:31:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1bb1e6b2-45f7-4e64-804f-9531095942be", "record_id": "flaws_cloudtrail:0000476:1bb1e6b2-45f7-4e64-804f-9531095942be", "row_index": 476, "timestamp": "2018-10-12T18:31:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1bb1e6b2-45f7-4e64-804f-9531095942be", "eventTime": "2018-10-12T18:31:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef3b155e-7e53-481f-b33d-8abd667be0d5", "record_id": "flaws_cloudtrail:0000477:ef3b155e-7e53-481f-b33d-8abd667be0d5", "row_index": 477, "timestamp": "2018-10-12T18:31:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef3b155e-7e53-481f-b33d-8abd667be0d5", "eventTime": "2018-10-12T18:31:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6010c2fa-b8c2-4ee9-942f-5ba1d74cd9b0", "record_id": "flaws_cloudtrail:0000478:6010c2fa-b8c2-4ee9-942f-5ba1d74cd9b0", "row_index": 478, "timestamp": "2018-10-12T18:31:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6010c2fa-b8c2-4ee9-942f-5ba1d74cd9b0", "eventTime": "2018-10-12T18:31:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6cfa228-42d9-4a3f-b3ab-d7fa0105918d", "record_id": "flaws_cloudtrail:0000479:e6cfa228-42d9-4a3f-b3ab-d7fa0105918d", "row_index": 479, "timestamp": "2018-10-12T18:31:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6cfa228-42d9-4a3f-b3ab-d7fa0105918d", "eventTime": "2018-10-12T18:31:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "441944c8-a487-4e3d-aea5-8550c7fb69d9", "record_id": "flaws_cloudtrail:0000480:441944c8-a487-4e3d-aea5-8550c7fb69d9", "row_index": 480, "timestamp": "2018-10-12T18:31:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "441944c8-a487-4e3d-aea5-8550c7fb69d9", "eventTime": "2018-10-12T18:31:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b14086e-9c9b-4c8d-b0e7-d22466bff1f0", "record_id": "flaws_cloudtrail:0000481:b14086e-9c9b-4c8d-b0e7-d22466bff1f0", "row_index": 481, "timestamp": "2018-10-12T18:31:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b14086e-9c9b-4c8d-b0e7-d22466bff1f0", "eventTime": "2018-10-12T18:31:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d168a92-9a25-4e60-9030-ca95d26ec18d", "record_id": "flaws_cloudtrail:0000482:5d168a92-9a25-4e60-9030-ca95d26ec18d", "row_index": 482, "timestamp": "2018-10-12T18:31:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d168a92-9a25-4e60-9030-ca95d26ec18d", "eventTime": "2018-10-12T18:31:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa3c274e-0dc5-4673-960e-4e974f705335", "record_id": "flaws_cloudtrail:0000483:aa3c274e-0dc5-4673-960e-4e974f705335", "row_index": 483, "timestamp": "2018-10-12T18:31:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa3c274e-0dc5-4673-960e-4e974f705335", "eventTime": "2018-10-12T18:31:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67e67f7b-0787-4a69-8074-3908a49731b1", "record_id": "flaws_cloudtrail:0000484:67e67f7b-0787-4a69-8074-3908a49731b1", "row_index": 484, "timestamp": "2018-10-12T18:31:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67e67f7b-0787-4a69-8074-3908a49731b1", "eventTime": "2018-10-12T18:31:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "914612fcf-6ca9-4549-b5bc-03ad81e1d7e9", "record_id": "flaws_cloudtrail:0000485:914612fcf-6ca9-4549-b5bc-03ad81e1d7e9", "row_index": 485, "timestamp": "2018-10-12T18:31:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "914612fcf-6ca9-4549-b5bc-03ad81e1d7e9", "eventTime": "2018-10-12T18:31:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "088828e7c-c871-4a05-80e3-84fc26aa39e4", "record_id": "flaws_cloudtrail:0000486:088828e7c-c871-4a05-80e3-84fc26aa39e4", "row_index": 486, "timestamp": "2018-10-12T18:31:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "088828e7c-c871-4a05-80e3-84fc26aa39e4", "eventTime": "2018-10-12T18:31:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa58e04c-b8d6-48f4-82ac-192c82fd74dd", "record_id": "flaws_cloudtrail:0000487:fa58e04c-b8d6-48f4-82ac-192c82fd74dd", "row_index": 487, "timestamp": "2018-10-12T18:31:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa58e04c-b8d6-48f4-82ac-192c82fd74dd", "eventTime": "2018-10-12T18:31:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac0728a6-a212-433b-9092-71dcd6b67c13", "record_id": "flaws_cloudtrail:0000488:ac0728a6-a212-433b-9092-71dcd6b67c13", "row_index": 488, "timestamp": "2018-10-12T18:31:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac0728a6-a212-433b-9092-71dcd6b67c13", "eventTime": "2018-10-12T18:31:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9eb0b691-de1f-4969-a83d-21a5e230db68", "record_id": "flaws_cloudtrail:0000489:9eb0b691-de1f-4969-a83d-21a5e230db68", "row_index": 489, "timestamp": "2018-10-12T18:31:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9eb0b691-de1f-4969-a83d-21a5e230db68", "eventTime": "2018-10-12T18:31:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b50449-ec23-4a38-8a63-e0e138c5e517", "record_id": "flaws_cloudtrail:0000490:b50449-ec23-4a38-8a63-e0e138c5e517", "row_index": 490, "timestamp": "2018-10-12T18:31:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b50449-ec23-4a38-8a63-e0e138c5e517", "eventTime": "2018-10-12T18:31:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e206137-e7e1-4924-972d-26d143b5a19f", "record_id": "flaws_cloudtrail:0000491:e206137-e7e1-4924-972d-26d143b5a19f", "row_index": 491, "timestamp": "2018-10-12T18:31:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e206137-e7e1-4924-972d-26d143b5a19f", "eventTime": "2018-10-12T18:31:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "625414a52-d675-452c-a44a-df011368ff19", "record_id": "flaws_cloudtrail:0000492:625414a52-d675-452c-a44a-df011368ff19", "row_index": 492, "timestamp": "2018-10-12T18:31:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "625414a52-d675-452c-a44a-df011368ff19", "eventTime": "2018-10-12T18:31:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19e4bec2-2898-43bb-a66e-2ccc1b0802f4", "record_id": "flaws_cloudtrail:0000493:19e4bec2-2898-43bb-a66e-2ccc1b0802f4", "row_index": 493, "timestamp": "2018-10-12T18:31:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19e4bec2-2898-43bb-a66e-2ccc1b0802f4", "eventTime": "2018-10-12T18:31:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d0aff03-6179-4e68-b598-bc507fa364c1", "record_id": "flaws_cloudtrail:0000494:2d0aff03-6179-4e68-b598-bc507fa364c1", "row_index": 494, "timestamp": "2018-10-12T18:31:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d0aff03-6179-4e68-b598-bc507fa364c1", "eventTime": "2018-10-12T18:31:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cbe64898-61c2-4059-a543-e3bd99c28869", "record_id": "flaws_cloudtrail:0000495:cbe64898-61c2-4059-a543-e3bd99c28869", "row_index": 495, "timestamp": "2018-10-12T18:31:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cbe64898-61c2-4059-a543-e3bd99c28869", "eventTime": "2018-10-12T18:31:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "971bae81-8561-47d4-9f0a-00b1584aa2ee", "record_id": "flaws_cloudtrail:0000496:971bae81-8561-47d4-9f0a-00b1584aa2ee", "row_index": 496, "timestamp": "2018-10-12T18:31:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "971bae81-8561-47d4-9f0a-00b1584aa2ee", "eventTime": "2018-10-12T18:31:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86f0c35c-a8d0-4729-81b1-219840fa9b22", "record_id": "flaws_cloudtrail:0000497:86f0c35c-a8d0-4729-81b1-219840fa9b22", "row_index": 497, "timestamp": "2018-10-12T18:31:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86f0c35c-a8d0-4729-81b1-219840fa9b22", "eventTime": "2018-10-12T18:31:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b52e19b-6b60-4d5e-8087-e926e7f88f98", "record_id": "flaws_cloudtrail:0000498:9b52e19b-6b60-4d5e-8087-e926e7f88f98", "row_index": 498, "timestamp": "2018-10-12T18:31:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b52e19b-6b60-4d5e-8087-e926e7f88f98", "eventTime": "2018-10-12T18:31:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7562e1de-02e4-4862-a5f5-229597ba258", "record_id": "flaws_cloudtrail:0000499:7562e1de-02e4-4862-a5f5-229597ba258", "row_index": 499, "timestamp": "2018-10-12T18:31:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7562e1de-02e4-4862-a5f5-229597ba258", "eventTime": "2018-10-12T18:31:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2789ed2e-7654-4082-b080-b4c1cad12db1", "record_id": "flaws_cloudtrail:0000500:2789ed2e-7654-4082-b080-b4c1cad12db1", "row_index": 500, "timestamp": "2018-10-12T18:31:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2789ed2e-7654-4082-b080-b4c1cad12db1", "eventTime": "2018-10-12T18:31:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa3a6891-dd5b-4382-ba1d-9039a673c6a1", "record_id": "flaws_cloudtrail:0000501:fa3a6891-dd5b-4382-ba1d-9039a673c6a1", "row_index": 501, "timestamp": "2018-10-12T18:31:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa3a6891-dd5b-4382-ba1d-9039a673c6a1", "eventTime": "2018-10-12T18:31:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5150e16-6f37-49fc-97c3-622703b1faed", "record_id": "flaws_cloudtrail:0000502:c5150e16-6f37-49fc-97c3-622703b1faed", "row_index": 502, "timestamp": "2018-10-12T18:31:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5150e16-6f37-49fc-97c3-622703b1faed", "eventTime": "2018-10-12T18:31:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b402dbdd-a7ae-4496-a02d-22fd9be0f71b", "record_id": "flaws_cloudtrail:0000503:b402dbdd-a7ae-4496-a02d-22fd9be0f71b", "row_index": 503, "timestamp": "2018-10-12T18:31:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b402dbdd-a7ae-4496-a02d-22fd9be0f71b", "eventTime": "2018-10-12T18:31:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ca7df3f-6458-4e00-96cd-4b2e05466195", "record_id": "flaws_cloudtrail:0000504:0ca7df3f-6458-4e00-96cd-4b2e05466195", "row_index": 504, "timestamp": "2018-10-12T18:31:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ca7df3f-6458-4e00-96cd-4b2e05466195", "eventTime": "2018-10-12T18:31:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a479287-5594-4e02-861f-c0bf3125ce63", "record_id": "flaws_cloudtrail:0000505:2a479287-5594-4e02-861f-c0bf3125ce63", "row_index": 505, "timestamp": "2018-10-12T18:31:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a479287-5594-4e02-861f-c0bf3125ce63", "eventTime": "2018-10-12T18:31:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "88d6f879-c7eb-4b0d-bf1c-726e9221ead0", "record_id": "flaws_cloudtrail:0000506:88d6f879-c7eb-4b0d-bf1c-726e9221ead0", "row_index": 506, "timestamp": "2018-10-12T18:31:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "88d6f879-c7eb-4b0d-bf1c-726e9221ead0", "eventTime": "2018-10-12T18:31:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61e96521-2a3c-492d-911f-8d8fc411b6a3", "record_id": "flaws_cloudtrail:0000507:61e96521-2a3c-492d-911f-8d8fc411b6a3", "row_index": 507, "timestamp": "2018-10-12T18:31:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61e96521-2a3c-492d-911f-8d8fc411b6a3", "eventTime": "2018-10-12T18:31:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fcd02b50-eb15-4253-80d9-0689bf917b16", "record_id": "flaws_cloudtrail:0000508:fcd02b50-eb15-4253-80d9-0689bf917b16", "row_index": 508, "timestamp": "2018-10-12T18:31:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fcd02b50-eb15-4253-80d9-0689bf917b16", "eventTime": "2018-10-12T18:31:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1290a3b4-a0bb-44af-90d4-c81b02cc7f01", "record_id": "flaws_cloudtrail:0000509:1290a3b4-a0bb-44af-90d4-c81b02cc7f01", "row_index": 509, "timestamp": "2018-10-12T18:31:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1290a3b4-a0bb-44af-90d4-c81b02cc7f01", "eventTime": "2018-10-12T18:31:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9334d174-d022-46b7-8604-fd9c694b6655", "record_id": "flaws_cloudtrail:0000510:9334d174-d022-46b7-8604-fd9c694b6655", "row_index": 510, "timestamp": "2018-10-12T18:31:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9334d174-d022-46b7-8604-fd9c694b6655", "eventTime": "2018-10-12T18:31:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e91cfbf1-64bc-4a00-9884-1e8aa295d8d2", "record_id": "flaws_cloudtrail:0000511:e91cfbf1-64bc-4a00-9884-1e8aa295d8d2", "row_index": 511, "timestamp": "2018-10-12T18:31:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e91cfbf1-64bc-4a00-9884-1e8aa295d8d2", "eventTime": "2018-10-12T18:31:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3108cbc-0cc9-4456-96a5-207a97d4d7ec", "record_id": "flaws_cloudtrail:0000512:a3108cbc-0cc9-4456-96a5-207a97d4d7ec", "row_index": 512, "timestamp": "2018-10-12T18:31:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3108cbc-0cc9-4456-96a5-207a97d4d7ec", "eventTime": "2018-10-12T18:31:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2dda9b7-7aa5-4107-89d3-d588982b2df3", "record_id": "flaws_cloudtrail:0000513:d2dda9b7-7aa5-4107-89d3-d588982b2df3", "row_index": 513, "timestamp": "2018-10-12T18:31:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2dda9b7-7aa5-4107-89d3-d588982b2df3", "eventTime": "2018-10-12T18:31:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71d3d0f3-3cf2-4506-89d7-d1a0a633bce4", "record_id": "flaws_cloudtrail:0000514:71d3d0f3-3cf2-4506-89d7-d1a0a633bce4", "row_index": 514, "timestamp": "2018-10-12T18:31:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71d3d0f3-3cf2-4506-89d7-d1a0a633bce4", "eventTime": "2018-10-12T18:31:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e03addb-21f6-4dd9-a529-aa597579a4d47", "record_id": "flaws_cloudtrail:0000515:0e03addb-21f6-4dd9-a529-aa597579a4d47", "row_index": 515, "timestamp": "2018-10-12T18:31:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e03addb-21f6-4dd9-a529-aa597579a4d47", "eventTime": "2018-10-12T18:31:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68aa7dab-e7d2-42df-aa2c-1d7782f403c9", "record_id": "flaws_cloudtrail:0000516:68aa7dab-e7d2-42df-aa2c-1d7782f403c9", "row_index": 516, "timestamp": "2018-10-12T18:31:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68aa7dab-e7d2-42df-aa2c-1d7782f403c9", "eventTime": "2018-10-12T18:31:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "900f5248-305b-4f6b-b030-0a3829c887575", "record_id": "flaws_cloudtrail:0000517:900f5248-305b-4f6b-b030-0a3829c887575", "row_index": 517, "timestamp": "2018-10-12T18:31:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "900f5248-305b-4f6b-b030-0a3829c887575", "eventTime": "2018-10-12T18:31:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb475b9f-3bad-45e5-a25f-025d654eb70d", "record_id": "flaws_cloudtrail:0000518:eb475b9f-3bad-45e5-a25f-025d654eb70d", "row_index": 518, "timestamp": "2018-10-12T18:31:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb475b9f-3bad-45e5-a25f-025d654eb70d", "eventTime": "2018-10-12T18:31:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "addf26e9-a069-43ca-b6ae-a295bc98f9db", "record_id": "flaws_cloudtrail:0000519:addf26e9-a069-43ca-b6ae-a295bc98f9db", "row_index": 519, "timestamp": "2018-10-12T18:31:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "addf26e9-a069-43ca-b6ae-a295bc98f9db", "eventTime": "2018-10-12T18:31:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ff51b5a-b934-4aa9-bee1-5006c55540e8", "record_id": "flaws_cloudtrail:0000520:7ff51b5a-b934-4aa9-bee1-5006c55540e8", "row_index": 520, "timestamp": "2018-10-12T18:31:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ff51b5a-b934-4aa9-bee1-5006c55540e8", "eventTime": "2018-10-12T18:31:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a2f2c2a-c82f-4ed4-b8c9-405f5e8caf52", "record_id": "flaws_cloudtrail:0000521:5a2f2c2a-c82f-4ed4-b8c9-405f5e8caf52", "row_index": 521, "timestamp": "2018-10-12T18:31:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a2f2c2a-c82f-4ed4-b8c9-405f5e8caf52", "eventTime": "2018-10-12T18:31:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "689a4865-5820-4078-86ea-69209a48c04c", "record_id": "flaws_cloudtrail:0000522:689a4865-5820-4078-86ea-69209a48c04c", "row_index": 522, "timestamp": "2018-10-12T18:31:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "689a4865-5820-4078-86ea-69209a48c04c", "eventTime": "2018-10-12T18:31:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7def46f2-6e2f-4cd7-a80e-3b4de2dc26cd", "record_id": "flaws_cloudtrail:0000523:7def46f2-6e2f-4cd7-a80e-3b4de2dc26cd", "row_index": 523, "timestamp": "2018-10-12T18:31:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7def46f2-6e2f-4cd7-a80e-3b4de2dc26cd", "eventTime": "2018-10-12T18:31:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "305d280c-1943-4134-9bb3-c31f1cfcf8ff", "record_id": "flaws_cloudtrail:0000524:305d280c-1943-4134-9bb3-c31f1cfcf8ff", "row_index": 524, "timestamp": "2018-10-12T18:31:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "305d280c-1943-4134-9bb3-c31f1cfcf8ff", "eventTime": "2018-10-12T18:31:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14a15eec-36d4-4409-b22c-512f7695b6d2", "record_id": "flaws_cloudtrail:0000525:14a15eec-36d4-4409-b22c-512f7695b6d2", "row_index": 525, "timestamp": "2018-10-12T18:31:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14a15eec-36d4-4409-b22c-512f7695b6d2", "eventTime": "2018-10-12T18:31:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e11a5675-1305-41d7-8ecb-f70f46ccd180", "record_id": "flaws_cloudtrail:0000526:e11a5675-1305-41d7-8ecb-f70f46ccd180", "row_index": 526, "timestamp": "2018-10-12T18:31:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e11a5675-1305-41d7-8ecb-f70f46ccd180", "eventTime": "2018-10-12T18:31:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6dc6c9d5-56dc-4ceb-af5c-ec55b5efa97c", "record_id": "flaws_cloudtrail:0000527:6dc6c9d5-56dc-4ceb-af5c-ec55b5efa97c", "row_index": 527, "timestamp": "2018-10-12T18:31:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6dc6c9d5-56dc-4ceb-af5c-ec55b5efa97c", "eventTime": "2018-10-12T18:31:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de032160d-6329-428f-8135-07823e8674", "record_id": "flaws_cloudtrail:0000528:de032160d-6329-428f-8135-07823e8674", "row_index": 528, "timestamp": "2018-10-12T18:31:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de032160d-6329-428f-8135-07823e8674", "eventTime": "2018-10-12T18:31:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cafce6d0-c8d6-4918-8077-d0decc8f4f66", "record_id": "flaws_cloudtrail:0000529:cafce6d0-c8d6-4918-8077-d0decc8f4f66", "row_index": 529, "timestamp": "2018-10-12T18:31:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cafce6d0-c8d6-4918-8077-d0decc8f4f66", "eventTime": "2018-10-12T18:31:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19ac06e9-a8ff-48dc-bbbd-0f1b6c3c0800", "record_id": "flaws_cloudtrail:0000530:19ac06e9-a8ff-48dc-bbbd-0f1b6c3c0800", "row_index": 530, "timestamp": "2018-10-12T18:31:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19ac06e9-a8ff-48dc-bbbd-0f1b6c3c0800", "eventTime": "2018-10-12T18:31:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a8137cd-1c8f-4891-a7dc-05beecb45912", "record_id": "flaws_cloudtrail:0000531:9a8137cd-1c8f-4891-a7dc-05beecb45912", "row_index": 531, "timestamp": "2018-10-12T18:31:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a8137cd-1c8f-4891-a7dc-05beecb45912", "eventTime": "2018-10-12T18:31:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "32734-fa6e-4cf9-accf-3c3478df9e35", "record_id": "flaws_cloudtrail:0000532:32734-fa6e-4cf9-accf-3c3478df9e35", "row_index": 532, "timestamp": "2018-10-12T18:31:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "32734-fa6e-4cf9-accf-3c3478df9e35", "eventTime": "2018-10-12T18:31:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "310dc3d9-ec24-4322-a9eb-7c93cfca8aeb", "record_id": "flaws_cloudtrail:0000533:310dc3d9-ec24-4322-a9eb-7c93cfca8aeb", "row_index": 533, "timestamp": "2018-10-12T18:31:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "310dc3d9-ec24-4322-a9eb-7c93cfca8aeb", "eventTime": "2018-10-12T18:31:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70c7b530-8f7d-49a1-ac60-1c54ec80cf25", "record_id": "flaws_cloudtrail:0000534:70c7b530-8f7d-49a1-ac60-1c54ec80cf25", "row_index": 534, "timestamp": "2018-10-12T18:31:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70c7b530-8f7d-49a1-ac60-1c54ec80cf25", "eventTime": "2018-10-12T18:31:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5707a243-f11e-435d-88a4-6567ce1f8ebf", "record_id": "flaws_cloudtrail:0000535:5707a243-f11e-435d-88a4-6567ce1f8ebf", "row_index": 535, "timestamp": "2018-10-12T18:31:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5707a243-f11e-435d-88a4-6567ce1f8ebf", "eventTime": "2018-10-12T18:31:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00ac5eb5-9104-406f-9f19-cfe3c90d832f", "record_id": "flaws_cloudtrail:0000536:00ac5eb5-9104-406f-9f19-cfe3c90d832f", "row_index": 536, "timestamp": "2018-10-12T18:31:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00ac5eb5-9104-406f-9f19-cfe3c90d832f", "eventTime": "2018-10-12T18:31:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9346c423-86a5-49d0-95bc-4f0e10267ac7", "record_id": "flaws_cloudtrail:0000537:9346c423-86a5-49d0-95bc-4f0e10267ac7", "row_index": 537, "timestamp": "2018-10-12T18:31:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9346c423-86a5-49d0-95bc-4f0e10267ac7", "eventTime": "2018-10-12T18:31:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "732dbfc1-4f06-47b4-aa0a-6eb5a2327b02", "record_id": "flaws_cloudtrail:0000538:732dbfc1-4f06-47b4-aa0a-6eb5a2327b02", "row_index": 538, "timestamp": "2018-10-12T18:31:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "732dbfc1-4f06-47b4-aa0a-6eb5a2327b02", "eventTime": "2018-10-12T18:31:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b50eea6-2add-4b06-b950-0dfefe2a396d", "record_id": "flaws_cloudtrail:0000539:7b50eea6-2add-4b06-b950-0dfefe2a396d", "row_index": 539, "timestamp": "2018-10-12T18:31:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b50eea6-2add-4b06-b950-0dfefe2a396d", "eventTime": "2018-10-12T18:31:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1487c110-8053-4b34-847c-da5294b2de40", "record_id": "flaws_cloudtrail:0000540:1487c110-8053-4b34-847c-da5294b2de40", "row_index": 540, "timestamp": "2018-10-12T18:31:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1487c110-8053-4b34-847c-da5294b2de40", "eventTime": "2018-10-12T18:31:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5138ada0-8485-4f68-94bd-2d1b971c87a8", "record_id": "flaws_cloudtrail:0000541:5138ada0-8485-4f68-94bd-2d1b971c87a8", "row_index": 541, "timestamp": "2018-10-12T18:31:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5138ada0-8485-4f68-94bd-2d1b971c87a8", "eventTime": "2018-10-12T18:31:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73e14187-ad0e-45a5-a359-00cb934a92b9", "record_id": "flaws_cloudtrail:0000542:73e14187-ad0e-45a5-a359-00cb934a92b9", "row_index": 542, "timestamp": "2018-10-12T18:31:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73e14187-ad0e-45a5-a359-00cb934a92b9", "eventTime": "2018-10-12T18:31:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "468292e-bece-4739-a495-549b647097a3e", "record_id": "flaws_cloudtrail:0000543:468292e-bece-4739-a495-549b647097a3e", "row_index": 543, "timestamp": "2018-10-12T18:31:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "468292e-bece-4739-a495-549b647097a3e", "eventTime": "2018-10-12T18:31:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91c32a47-f114-496b-b1c0-108788e67cf", "record_id": "flaws_cloudtrail:0000544:91c32a47-f114-496b-b1c0-108788e67cf", "row_index": 544, "timestamp": "2018-10-12T18:31:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91c32a47-f114-496b-b1c0-108788e67cf", "eventTime": "2018-10-12T18:31:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "332bb998-dfc0-4e57-a6d0-d33f6cf494af", "record_id": "flaws_cloudtrail:0000545:332bb998-dfc0-4e57-a6d0-d33f6cf494af", "row_index": 545, "timestamp": "2018-10-12T18:31:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "332bb998-dfc0-4e57-a6d0-d33f6cf494af", "eventTime": "2018-10-12T18:31:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8696f7c2-6899-4e40-93f5-2820b8776c40", "record_id": "flaws_cloudtrail:0000546:8696f7c2-6899-4e40-93f5-2820b8776c40", "row_index": 546, "timestamp": "2018-10-12T18:31:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8696f7c2-6899-4e40-93f5-2820b8776c40", "eventTime": "2018-10-12T18:31:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff8b17e9-393b-4c4e-a9ce-93152e87d2e1", "record_id": "flaws_cloudtrail:0000547:ff8b17e9-393b-4c4e-a9ce-93152e87d2e1", "row_index": 547, "timestamp": "2018-10-12T18:31:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff8b17e9-393b-4c4e-a9ce-93152e87d2e1", "eventTime": "2018-10-12T18:31:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be7bbcf9-3399-4246-bfe5-055117d90707", "record_id": "flaws_cloudtrail:0000548:be7bbcf9-3399-4246-bfe5-055117d90707", "row_index": 548, "timestamp": "2018-10-12T18:31:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be7bbcf9-3399-4246-bfe5-055117d90707", "eventTime": "2018-10-12T18:31:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "493147-29cc-4b75-a466-195f6e5a9553", "record_id": "flaws_cloudtrail:0000549:493147-29cc-4b75-a466-195f6e5a9553", "row_index": 549, "timestamp": "2018-10-12T18:31:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "493147-29cc-4b75-a466-195f6e5a9553", "eventTime": "2018-10-12T18:31:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9486dd06-db9f-4589-8666-cb4793c875f1", "record_id": "flaws_cloudtrail:0000550:9486dd06-db9f-4589-8666-cb4793c875f1", "row_index": 550, "timestamp": "2018-10-12T18:31:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9486dd06-db9f-4589-8666-cb4793c875f1", "eventTime": "2018-10-12T18:31:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fed02c5c-a891-4a3f-b6d0-4298d4dcbfab", "record_id": "flaws_cloudtrail:0000551:fed02c5c-a891-4a3f-b6d0-4298d4dcbfab", "row_index": 551, "timestamp": "2018-10-12T18:31:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fed02c5c-a891-4a3f-b6d0-4298d4dcbfab", "eventTime": "2018-10-12T18:31:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "28dbca8a-e2b1-4b07-b311-e4db6bd3a192", "record_id": "flaws_cloudtrail:0000552:28dbca8a-e2b1-4b07-b311-e4db6bd3a192", "row_index": 552, "timestamp": "2018-10-12T18:31:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "28dbca8a-e2b1-4b07-b311-e4db6bd3a192", "eventTime": "2018-10-12T18:31:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e356c483-8635-4645-a74f-045d3031cc3e", "record_id": "flaws_cloudtrail:0000553:e356c483-8635-4645-a74f-045d3031cc3e", "row_index": 553, "timestamp": "2018-10-12T18:31:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e356c483-8635-4645-a74f-045d3031cc3e", "eventTime": "2018-10-12T18:31:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69a20ab1-1fd7-4277-954d-5a7979f7d55f", "record_id": "flaws_cloudtrail:0000554:69a20ab1-1fd7-4277-954d-5a7979f7d55f", "row_index": 554, "timestamp": "2018-10-12T18:31:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69a20ab1-1fd7-4277-954d-5a7979f7d55f", "eventTime": "2018-10-12T18:31:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3241a585-cce0-4680-9a4f-8f75f6b05781", "record_id": "flaws_cloudtrail:0000555:3241a585-cce0-4680-9a4f-8f75f6b05781", "row_index": 555, "timestamp": "2018-10-12T18:31:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3241a585-cce0-4680-9a4f-8f75f6b05781", "eventTime": "2018-10-12T18:31:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c7c7f2a-a7ba-4652-b1b2-c668c1c311e6", "record_id": "flaws_cloudtrail:0000556:0c7c7f2a-a7ba-4652-b1b2-c668c1c311e6", "row_index": 556, "timestamp": "2018-10-12T18:31:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c7c7f2a-a7ba-4652-b1b2-c668c1c311e6", "eventTime": "2018-10-12T18:31:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c16514ac-3dba-40ce-a4d4-91268c17887", "record_id": "flaws_cloudtrail:0000557:c16514ac-3dba-40ce-a4d4-91268c17887", "row_index": 557, "timestamp": "2018-10-12T18:31:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c16514ac-3dba-40ce-a4d4-91268c17887", "eventTime": "2018-10-12T18:31:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8eeaffde-a12e-4454-9283-4a3ed7c3fd6f", "record_id": "flaws_cloudtrail:0000558:8eeaffde-a12e-4454-9283-4a3ed7c3fd6f", "row_index": 558, "timestamp": "2018-10-12T18:31:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8eeaffde-a12e-4454-9283-4a3ed7c3fd6f", "eventTime": "2018-10-12T18:31:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc74949-a3c9-4468-b802-5aed0f1e6c94", "record_id": "flaws_cloudtrail:0000559:dc74949-a3c9-4468-b802-5aed0f1e6c94", "row_index": 559, "timestamp": "2018-10-12T18:31:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc74949-a3c9-4468-b802-5aed0f1e6c94", "eventTime": "2018-10-12T18:31:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a6c5b34-5398-4d15-b45c-da88a99a3238", "record_id": "flaws_cloudtrail:0000560:9a6c5b34-5398-4d15-b45c-da88a99a3238", "row_index": 560, "timestamp": "2018-10-12T18:31:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a6c5b34-5398-4d15-b45c-da88a99a3238", "eventTime": "2018-10-12T18:31:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78170d3f-a142-47ea-9a84-59fda675685", "record_id": "flaws_cloudtrail:0000561:78170d3f-a142-47ea-9a84-59fda675685", "row_index": 561, "timestamp": "2018-10-12T18:31:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78170d3f-a142-47ea-9a84-59fda675685", "eventTime": "2018-10-12T18:31:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c01c9719-9165-412b-82a5-259c8b16a603", "record_id": "flaws_cloudtrail:0000562:c01c9719-9165-412b-82a5-259c8b16a603", "row_index": 562, "timestamp": "2018-10-12T18:31:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c01c9719-9165-412b-82a5-259c8b16a603", "eventTime": "2018-10-12T18:31:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2fbb591-75d4-459c-8cfc-325ef1d4e48f", "record_id": "flaws_cloudtrail:0000563:a2fbb591-75d4-459c-8cfc-325ef1d4e48f", "row_index": 563, "timestamp": "2018-10-12T18:31:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2fbb591-75d4-459c-8cfc-325ef1d4e48f", "eventTime": "2018-10-12T18:31:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e94fb4ce-f638-4cc0-920f-f670c34e4dfd", "record_id": "flaws_cloudtrail:0000564:e94fb4ce-f638-4cc0-920f-f670c34e4dfd", "row_index": 564, "timestamp": "2018-10-12T18:31:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e94fb4ce-f638-4cc0-920f-f670c34e4dfd", "eventTime": "2018-10-12T18:31:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b872f32-ed3f-4b60-8f1c-98505e8049d3", "record_id": "flaws_cloudtrail:0000565:5b872f32-ed3f-4b60-8f1c-98505e8049d3", "row_index": 565, "timestamp": "2018-10-12T18:31:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b872f32-ed3f-4b60-8f1c-98505e8049d3", "eventTime": "2018-10-12T18:31:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6a64e85-297a-4557-8787-37c23c674714e", "record_id": "flaws_cloudtrail:0000566:f6a64e85-297a-4557-8787-37c23c674714e", "row_index": 566, "timestamp": "2018-10-12T18:31:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6a64e85-297a-4557-8787-37c23c674714e", "eventTime": "2018-10-12T18:31:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52a0ec86-8a98-4a1a-b8cf-477e356616a9", "record_id": "flaws_cloudtrail:0000567:52a0ec86-8a98-4a1a-b8cf-477e356616a9", "row_index": 567, "timestamp": "2018-10-12T18:31:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52a0ec86-8a98-4a1a-b8cf-477e356616a9", "eventTime": "2018-10-12T18:31:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42b8ad55-42eb-4802-8820-10f9e18417a", "record_id": "flaws_cloudtrail:0000568:42b8ad55-42eb-4802-8820-10f9e18417a", "row_index": 568, "timestamp": "2018-10-12T18:31:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42b8ad55-42eb-4802-8820-10f9e18417a", "eventTime": "2018-10-12T18:31:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "549137f7-72c9-4837-aff5-131f2f71c9b4", "record_id": "flaws_cloudtrail:0000569:549137f7-72c9-4837-aff5-131f2f71c9b4", "row_index": 569, "timestamp": "2018-10-12T18:31:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "549137f7-72c9-4837-aff5-131f2f71c9b4", "eventTime": "2018-10-12T18:31:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc8981aa-6340-4439-9ba1-b540844f55", "record_id": "flaws_cloudtrail:0000570:bc8981aa-6340-4439-9ba1-b540844f55", "row_index": 570, "timestamp": "2018-10-12T18:31:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc8981aa-6340-4439-9ba1-b540844f55", "eventTime": "2018-10-12T18:31:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e338e91f-58ae-4100-a610-c7485a4d2561", "record_id": "flaws_cloudtrail:0000571:e338e91f-58ae-4100-a610-c7485a4d2561", "row_index": 571, "timestamp": "2018-10-12T18:31:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e338e91f-58ae-4100-a610-c7485a4d2561", "eventTime": "2018-10-12T18:31:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c885469-4510-47c8-8b98-99efc7b6ec69", "record_id": "flaws_cloudtrail:0000572:c885469-4510-47c8-8b98-99efc7b6ec69", "row_index": 572, "timestamp": "2018-10-12T18:31:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c885469-4510-47c8-8b98-99efc7b6ec69", "eventTime": "2018-10-12T18:31:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6185d390-92bf-40ae-916d-949d0feedb6a", "record_id": "flaws_cloudtrail:0000573:6185d390-92bf-40ae-916d-949d0feedb6a", "row_index": 573, "timestamp": "2018-10-12T18:31:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6185d390-92bf-40ae-916d-949d0feedb6a", "eventTime": "2018-10-12T18:31:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "116f7a42-9c10-4851-8754-0bf1d113df30", "record_id": "flaws_cloudtrail:0000574:116f7a42-9c10-4851-8754-0bf1d113df30", "row_index": 574, "timestamp": "2018-10-12T18:31:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "116f7a42-9c10-4851-8754-0bf1d113df30", "eventTime": "2018-10-12T18:31:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ef52e8f-3c2c-476b-8499-b459620fa5a2", "record_id": "flaws_cloudtrail:0000575:5ef52e8f-3c2c-476b-8499-b459620fa5a2", "row_index": 575, "timestamp": "2018-10-12T18:31:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ef52e8f-3c2c-476b-8499-b459620fa5a2", "eventTime": "2018-10-12T18:31:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74eeaa83-8459-4a20-9278-b0b977838ea7b", "record_id": "flaws_cloudtrail:0000576:74eeaa83-8459-4a20-9278-b0b977838ea7b", "row_index": 576, "timestamp": "2018-10-12T18:31:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74eeaa83-8459-4a20-9278-b0b977838ea7b", "eventTime": "2018-10-12T18:31:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b678d22-9bfb-4d56-8309-7b60a0e41b90", "record_id": "flaws_cloudtrail:0000577:2b678d22-9bfb-4d56-8309-7b60a0e41b90", "row_index": 577, "timestamp": "2018-10-12T18:31:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b678d22-9bfb-4d56-8309-7b60a0e41b90", "eventTime": "2018-10-12T18:31:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a1730e3-15c0-4cd9-a56f-ad04eb8913de", "record_id": "flaws_cloudtrail:0000578:1a1730e3-15c0-4cd9-a56f-ad04eb8913de", "row_index": 578, "timestamp": "2018-10-12T18:31:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a1730e3-15c0-4cd9-a56f-ad04eb8913de", "eventTime": "2018-10-12T18:31:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7debf68-f862-43b7-8277-a56af4a4970a", "record_id": "flaws_cloudtrail:0000579:e7debf68-f862-43b7-8277-a56af4a4970a", "row_index": 579, "timestamp": "2018-10-12T18:31:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7debf68-f862-43b7-8277-a56af4a4970a", "eventTime": "2018-10-12T18:31:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a101cf0-45f8-4dda-ab0a-e0be39b22ac1", "record_id": "flaws_cloudtrail:0000580:3a101cf0-45f8-4dda-ab0a-e0be39b22ac1", "row_index": 580, "timestamp": "2018-10-12T18:31:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a101cf0-45f8-4dda-ab0a-e0be39b22ac1", "eventTime": "2018-10-12T18:31:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f2f96b9-03bf-4050-8fb1-ea813d0152a6", "record_id": "flaws_cloudtrail:0000581:3f2f96b9-03bf-4050-8fb1-ea813d0152a6", "row_index": 581, "timestamp": "2018-10-12T18:31:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f2f96b9-03bf-4050-8fb1-ea813d0152a6", "eventTime": "2018-10-12T18:31:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edd98cbe-874d-48b3-b5c3-3c85ad73c8a2", "record_id": "flaws_cloudtrail:0000582:edd98cbe-874d-48b3-b5c3-3c85ad73c8a2", "row_index": 582, "timestamp": "2018-10-12T18:31:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edd98cbe-874d-48b3-b5c3-3c85ad73c8a2", "eventTime": "2018-10-12T18:31:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21c8696c-374a-4a8d-af60-9d2a26c0ee64", "record_id": "flaws_cloudtrail:0000583:21c8696c-374a-4a8d-af60-9d2a26c0ee64", "row_index": 583, "timestamp": "2018-10-12T18:31:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21c8696c-374a-4a8d-af60-9d2a26c0ee64", "eventTime": "2018-10-12T18:31:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a831772-f5de-40a1-ae03-7610fb424d51", "record_id": "flaws_cloudtrail:0000584:a831772-f5de-40a1-ae03-7610fb424d51", "row_index": 584, "timestamp": "2018-10-12T18:31:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a831772-f5de-40a1-ae03-7610fb424d51", "eventTime": "2018-10-12T18:31:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9391c758-76a1-4feb-b73e-6fe54130ccc0", "record_id": "flaws_cloudtrail:0000585:9391c758-76a1-4feb-b73e-6fe54130ccc0", "row_index": 585, "timestamp": "2018-10-12T18:31:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9391c758-76a1-4feb-b73e-6fe54130ccc0", "eventTime": "2018-10-12T18:31:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ad95a90-c4c4-4e53-9ada-f9e0d8c23387", "record_id": "flaws_cloudtrail:0000586:4ad95a90-c4c4-4e53-9ada-f9e0d8c23387", "row_index": 586, "timestamp": "2018-10-12T18:31:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ad95a90-c4c4-4e53-9ada-f9e0d8c23387", "eventTime": "2018-10-12T18:31:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a0c446f-2825-4c6f-873d-fa61e364b9bb", "record_id": "flaws_cloudtrail:0000587:0a0c446f-2825-4c6f-873d-fa61e364b9bb", "row_index": 587, "timestamp": "2018-10-12T18:31:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a0c446f-2825-4c6f-873d-fa61e364b9bb", "eventTime": "2018-10-12T18:31:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "efca2edb-a715-47c8-b82a-b09ee4a46eac", "record_id": "flaws_cloudtrail:0000588:efca2edb-a715-47c8-b82a-b09ee4a46eac", "row_index": 588, "timestamp": "2018-10-12T18:31:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "efca2edb-a715-47c8-b82a-b09ee4a46eac", "eventTime": "2018-10-12T18:31:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea074f35-b63a-41b4-bf6a-f83222fc4c6d", "record_id": "flaws_cloudtrail:0000589:ea074f35-b63a-41b4-bf6a-f83222fc4c6d", "row_index": 589, "timestamp": "2018-10-12T18:31:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea074f35-b63a-41b4-bf6a-f83222fc4c6d", "eventTime": "2018-10-12T18:31:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "828374cb-50ed-4307-bff7-8250c9b9f459", "record_id": "flaws_cloudtrail:0000590:828374cb-50ed-4307-bff7-8250c9b9f459", "row_index": 590, "timestamp": "2018-10-12T18:31:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "828374cb-50ed-4307-bff7-8250c9b9f459", "eventTime": "2018-10-12T18:31:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9242b94b-ac47-42c9-a2e8-ca28431a2724", "record_id": "flaws_cloudtrail:0000591:9242b94b-ac47-42c9-a2e8-ca28431a2724", "row_index": 591, "timestamp": "2018-10-12T18:31:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9242b94b-ac47-42c9-a2e8-ca28431a2724", "eventTime": "2018-10-12T18:31:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d824a01f-786f-48d2-958a-adcca173fa6a", "record_id": "flaws_cloudtrail:0000592:d824a01f-786f-48d2-958a-adcca173fa6a", "row_index": 592, "timestamp": "2018-10-12T18:31:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d824a01f-786f-48d2-958a-adcca173fa6a", "eventTime": "2018-10-12T18:31:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf5145a7-a8e4-46c7-ae98-f5a920c71fca", "record_id": "flaws_cloudtrail:0000593:cf5145a7-a8e4-46c7-ae98-f5a920c71fca", "row_index": 593, "timestamp": "2018-10-12T18:31:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf5145a7-a8e4-46c7-ae98-f5a920c71fca", "eventTime": "2018-10-12T18:31:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fa88af9-4b39-4968-adf3-c37354e49b6a", "record_id": "flaws_cloudtrail:0000594:0fa88af9-4b39-4968-adf3-c37354e49b6a", "row_index": 594, "timestamp": "2018-10-12T18:31:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fa88af9-4b39-4968-adf3-c37354e49b6a", "eventTime": "2018-10-12T18:31:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec5a3c1e-1bee-4236-9d6d-e234e2b6b911", "record_id": "flaws_cloudtrail:0000595:ec5a3c1e-1bee-4236-9d6d-e234e2b6b911", "row_index": 595, "timestamp": "2018-10-12T18:31:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec5a3c1e-1bee-4236-9d6d-e234e2b6b911", "eventTime": "2018-10-12T18:31:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cf5a82c-ee97-4ed8-ae3a-64ce31fb67ca", "record_id": "flaws_cloudtrail:0000596:8cf5a82c-ee97-4ed8-ae3a-64ce31fb67ca", "row_index": 596, "timestamp": "2018-10-12T18:31:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cf5a82c-ee97-4ed8-ae3a-64ce31fb67ca", "eventTime": "2018-10-12T18:31:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42065d9d-3725-46c4-ad83-754bb95c3123", "record_id": "flaws_cloudtrail:0000597:42065d9d-3725-46c4-ad83-754bb95c3123", "row_index": 597, "timestamp": "2018-10-12T18:31:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42065d9d-3725-46c4-ad83-754bb95c3123", "eventTime": "2018-10-12T18:31:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89fd6569-6552-4a20-8572-38fe13a6b9c1", "record_id": "flaws_cloudtrail:0000598:89fd6569-6552-4a20-8572-38fe13a6b9c1", "row_index": 598, "timestamp": "2018-10-12T18:31:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89fd6569-6552-4a20-8572-38fe13a6b9c1", "eventTime": "2018-10-12T18:31:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0c263449-70a3-43f2-9b99-197c41b3d0f5", "record_id": "flaws_cloudtrail:0000599:f0c263449-70a3-43f2-9b99-197c41b3d0f5", "row_index": 599, "timestamp": "2018-10-12T18:31:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0c263449-70a3-43f2-9b99-197c41b3d0f5", "eventTime": "2018-10-12T18:31:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7dd6e564-64d5-409f-9577-5e15ef6186b9", "record_id": "flaws_cloudtrail:0000600:7dd6e564-64d5-409f-9577-5e15ef6186b9", "row_index": 600, "timestamp": "2018-10-12T18:31:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7dd6e564-64d5-409f-9577-5e15ef6186b9", "eventTime": "2018-10-12T18:31:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "416fc2c5-a944-48ea-9f2a-802a473d1b81", "record_id": "flaws_cloudtrail:0000601:416fc2c5-a944-48ea-9f2a-802a473d1b81", "row_index": 601, "timestamp": "2018-10-12T18:31:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "416fc2c5-a944-48ea-9f2a-802a473d1b81", "eventTime": "2018-10-12T18:31:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d412ca4f-51a8-45e2-af33-c8a67a967998d", "record_id": "flaws_cloudtrail:0000602:d412ca4f-51a8-45e2-af33-c8a67a967998d", "row_index": 602, "timestamp": "2018-10-12T18:31:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d412ca4f-51a8-45e2-af33-c8a67a967998d", "eventTime": "2018-10-12T18:31:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c44397a-5d42-4a0f-a6e7-1227de1261ab", "record_id": "flaws_cloudtrail:0000603:c44397a-5d42-4a0f-a6e7-1227de1261ab", "row_index": 603, "timestamp": "2018-10-12T18:31:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c44397a-5d42-4a0f-a6e7-1227de1261ab", "eventTime": "2018-10-12T18:31:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15562ad1-3cd9-47aa-99e9-9816c73df9b6", "record_id": "flaws_cloudtrail:0000604:15562ad1-3cd9-47aa-99e9-9816c73df9b6", "row_index": 604, "timestamp": "2018-10-12T18:31:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15562ad1-3cd9-47aa-99e9-9816c73df9b6", "eventTime": "2018-10-12T18:31:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f80e5163-ef96-434d-b014-d21c7f66c367", "record_id": "flaws_cloudtrail:0000605:f80e5163-ef96-434d-b014-d21c7f66c367", "row_index": 605, "timestamp": "2018-10-12T18:31:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "6.193.205.117", "user_agent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f80e5163-ef96-434d-b014-d21c7f66c367", "eventTime": "2018-10-12T18:31:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.193.205.117", "userAgent": "Boto3/1.7.48 Python/3.5.3 Linux/4.9.0-7-amd64 Botocore/1.10.48", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Not authorized to perform sts:AssumeRole", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}