Fixing AWS CloudTrail username parsing

philhagen / sof-elk

Configuration files for the SOF-ELK VM

GNU General Public License v3.0

1.47k stars 276 forks source link

Fixing AWS CloudTrail username parsing #336

Closed ForensicITGuy closed 4 days ago

ForensicITGuy commented 5 days ago

Hey @philhagen ! I was working with CloudTrail log files from the flaws.cloud dataset here: https://summitroute.com/blog/2020/10/09/public_dataset_of_cloudtrail_logs_from_flaws_cloud/

I noticed that the userName field wasn't parsing properly (presumably due to case sensitivity in the mutation configurations), so I fixed that and tested it on my local VM.

philhagen commented 4 days ago

Great catch - thanks, Tony! Will get this integrated on both live and upstream/pending branches asap.