StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
The following adds relevant fields from 1.07 & 1.08 where it seemed appropriate.
I have commented on each field added the relevant AWS documentation which was available.
Exclusions
At this time I have excluded the field edgeDeviceDetails This is exclusive to outpost and I cannot find any log examples to reference and confirm the type.
edgeDeviceDetails
Shows information about edge devices that are targets of a request. Currently, S3 Outposts device events include this field.
Since: 1.08
Optional: True
Changes
Added fields
addendum
eventCategory
insightDetails
sessionCredentialFromConsole
tlsDetails
Testing
No testing due to lack of logs to check against, I welcome examples submissions.
to: cc: @airbnb/streamalert-maintainers related to: resolves:
Background
AWS releases a new version of the cloud trail schema
1.08
as found in https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.htmlThe following adds relevant fields from
1.07
&1.08
where it seemed appropriate.I have commented on each field added the relevant AWS documentation which was available.
Exclusions
At this time I have excluded the field
edgeDeviceDetails
This is exclusive to outpost and I cannot find any log examples to reference and confirm the type.Changes
Added fields
Testing
No testing due to lack of logs to check against, I welcome examples submissions.