Data Source: AWS Bedrock Claude

Created: 2026-05-20

Last Updated: 2026-10-14

ID: b7c91d3a-ef52-4b8e-9c2d-ae047f6b3e21

Author: Rod Soto, Splunk

Description

Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information.

Details

Property	Value
Source	`aws_bedrock`
Sourcetype	`json_no_timestamp`
Separator	schemaType

Name ▲▼	Technique ▲▼	Type ▲▼
AWS Bedrock Claude Unusually Large Prompts	Process Injection	Anomaly
AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation	Process Injection	Anomaly
AWS Bedrock Claude Hostile Prompt Sentiment	Process Injection	Anomaly
AWS Bedrock Claude Possible Prompt Injection	Process Injection	Hunting
AWS Bedrock Claude Sensitive Data in Prompts	Process Injection	Anomaly
AWS Bedrock Claude Cross Region Possible Inference Abuse	Network Boundary Bridging	Anomaly
AWS Bedrock Claude excessive use of tokens	Process Injection	Anomaly

Supported Apps

Splunk Add-on for AWS (version 8.2.2)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">accountId</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">identity.arn</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">inferenceRegion</span>
  
  <span class="pill kill-chain">input.cacheReadInputTokenCount</span>
  
  <span class="pill kill-chain">input.cacheWriteInputTokenCount</span>
  
  <span class="pill kill-chain">input.inputBodyJson.anthropic_beta{}</span>
  
  <span class="pill kill-chain">input.inputBodyJson.anthropic_version</span>
  
  <span class="pill kill-chain">input.inputBodyJson.max_tokens</span>
  
  <span class="pill kill-chain">input.inputBodyJson.messages{}.content{}.cache_control.type</span>
  
  <span class="pill kill-chain">input.inputBodyJson.messages{}.content{}.text</span>
  
  <span class="pill kill-chain">input.inputBodyJson.messages{}.content{}.type</span>
  
  <span class="pill kill-chain">input.inputBodyJson.messages{}.role</span>
  
  <span class="pill kill-chain">input.inputBodyJson.metadata.user_id</span>
  
  <span class="pill kill-chain">input.inputBodyJson.system{}.cache_control.type</span>
  
  <span class="pill kill-chain">input.inputBodyJson.system{}.text</span>
  
  <span class="pill kill-chain">input.inputBodyJson.system{}.type</span>
  
  <span class="pill kill-chain">input.inputBodyJson.temperature</span>
  
  <span class="pill kill-chain">input.inputContentType</span>
  
  <span class="pill kill-chain">input.inputTokenCount</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">modelId</span>
  
  <span class="pill kill-chain">operation</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.amazon-bedrock-invocationMetrics.firstByteLatency</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.amazon-bedrock-invocationMetrics.inputTokenCount</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.amazon-bedrock-invocationMetrics.invocationLatency</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.amazon-bedrock-invocationMetrics.outputTokenCount</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.content_block.text</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.content_block.type</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.delta.stop_reason</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.delta.stop_sequence</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.delta.text</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.delta.type</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.index</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.id</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.model</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.role</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.stop_reason</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.stop_sequence</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.type</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.usage.cache_creation.ephemeral_1h_input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.usage.cache_creation.ephemeral_5m_input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.usage.cache_creation_input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.usage.cache_read_input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.usage.input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.message.usage.output_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.type</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.usage.cache_creation_input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.usage.cache_read_input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.usage.input_tokens</span>
  
  <span class="pill kill-chain">output.outputBodyJson{}.usage.output_tokens</span>
  
  <span class="pill kill-chain">output.outputContentType</span>
  
  <span class="pill kill-chain">output.outputTokenCount</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">region</span>
  
  <span class="pill kill-chain">requestId</span>
  
  <span class="pill kill-chain">schemaType</span>
  
  <span class="pill kill-chain">schemaVersion</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">timestamp</span>
  
</div>

Example Log

1{"timestamp":"2026-05-07T17:25:54Z","accountId":"387769110234","region":"us-west-2","requestId":"f3b55895-e86b-4361-b049-939c415864ec","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/30gg9eioz4ca","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: psql -h localhost -U foo_dev -d detector_optimization -c \"SELECT org_id, status, last_scan_at FROM scans;\"\nOutput: BqDQY5OAAAA | success | 2026-05-06 00:28:27"}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic's official CLI for Claude."}],"tools":[],"metadata":{"user_id":"user_120425bc83874fef93db29aaf0b716bb_account__session_1c3dc58a-bb6b-4380-982d-6cc8b0a00b8c"},"max_tokens":16384,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":23,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":23,"outputTokenCount":25,"invocationLatency":900,"firstByteLatency":600}}],"outputTokenCount":25},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/jani@foo.com"},"inferenceRegion":"us-west-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}

Required Output Fields

user
user_arn
session_user
model_short
input_tokens
output_tokens
token_ratio
mismatch_detail
operation
host

Source: GitHub | Version: 2