Data Source: AWS CloudTrail PutImage

Date: 2025-01-23

ID: bb13f10d-0d8c-4fde-9136-b7cfd930e87c

Author: Patrick Bareiss, Splunk

Description

Logs an event when a container image is uploaded to a repository in AWS CloudTrail.

Details

Property	Value
Source	`aws_cloudtrail`
Sourcetype	`aws:cloudtrail`
Separator	eventName

Supported Apps

Splunk Add-on for AWS (version 7.9.1)

Event Fields

+ Fields


            1
            _time
          
            3
            app
          
            5
            awsRegion
          
            7
            aws_account_id
          
            9
            command
          
            11
            date_hour
          
            13
            date_mday
          
            15
            date_minute
          
            17
            date_month
          
            19
            date_second
          
            21
            date_wday
          
            23
            date_year
          
            25
            date_zone
          
            27
            dest
          
            29
            dvc
          
            31
            errorCode
          
            33
            eventCategory
          
            35
            eventID
          
            37
            eventName
          
            39
            eventSource
          
            41
            eventTime
          
            43
            eventType
          
            45
            eventVersion
          
            47
            host
          
            49
            index
          
            51
            linecount
          
            53
            managementEvent
          
            55
            msg
          
            57
            object_category
          
            59
            product
          
            61
            punct
          
            63
            readOnly
          
            65
            recipientAccountId
          
            67
            region
          
            69
            requestID
          
            71
            requestParameters.imageManifest
          
            73
            requestParameters.imageManifestMediaType
          
            75
            requestParameters.imageTag
          
            77
            requestParameters.registryId
          
            79
            requestParameters.repositoryName
          
            81
            resources{}.ARN
          
            83
            resources{}.accountId
          
            85
            responseElements.image.imageId.imageDigest
          
            87
            responseElements.image.imageId.imageTag
          
            89
            responseElements.image.imageManifest
          
            91
            responseElements.image.imageManifestMediaType
          
            93
            responseElements.image.registryId
          
            95
            responseElements.image.repositoryName
          
            97
            signature
          
            99
            source
          
            101
            sourceIPAddress
          
            103
            sourcetype
          
            105
            splunk_server
          
            107
            src
          
            109
            src_ip
          
            111
            start_time
          
            113
            timeendpos
          
            115
            timestartpos
          
            117
            user
          
            119
            userAgent
          
            121
            userIdentity.accessKeyId
          
            123
            userIdentity.accountId
          
            125
            userIdentity.arn
          
            127
            userIdentity.invokedBy
          
            129
            userIdentity.principalId
          
            131
            userIdentity.sessionContext.attributes.creationDate
          
            133
            userIdentity.sessionContext.attributes.mfaAuthenticated
          
            135
            userIdentity.type
          
            137
            userIdentity.userName
          
            139
            userName
          
            141
            user_access_key
          
            143
            user_agent
          
            145
            user_arn
          
            147
            user_group_id
          
            149
            user_id
          
            151
            user_name
          
            153
            user_type
          
            155
            vendor
          
            157
            vendor_account
          
            159
            vendor_product
          
            161
            vendor_region
          
            163

...

not set

Example Log

1{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AAAAAAAAAAAAAAAAAAAAA", "arn": "arn:aws:iam::111111111111:user/test", "accountId": "111111111111", "accessKeyId": "AAAAAAAAAAAAAAAAAAAAA", "userName": "test", "sessionContext": {"sessionIssuer": {}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-18T23:15:39Z", "mfaAuthenticated": "false"}}, "invokedBy": "AWS Internal"}, "eventTime": "2021-08-18T23:17:30Z", "eventSource": "ecr.amazonaws.com", "eventName": "PutImage", "awsRegion": "eu-central-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageManifest": "{\n   \"schemaVersion\": 2,\n   \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n   \"config\": {\n      \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n      \"size\": 6591,\n      \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n   },\n   \"layers\": [\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 2811969,\n         \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 35426616,\n         \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 2347076,\n         \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 280,\n         \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 92,\n         \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 373,\n         \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 2383293,\n         \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 10001,\n         \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n      }\n   ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json", "imageTag": "latest"}, "responseElements": {"image": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageId": {"imageDigest": "sha256:b7798f35949cc1a2d435c9ac59ab69e857fe635a359c96e4f56a8498ce02019c", "imageTag": "latest"}, "imageManifest": "{\n   \"schemaVersion\": 2,\n   \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n   \"config\": {\n      \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n      \"size\": 6591,\n      \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n   },\n   \"layers\": [\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 2811969,\n         \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 35426616,\n         \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 2347076,\n         \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 280,\n         \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 92,\n         \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 373,\n         \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 2383293,\n         \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n      },\n      {\n         \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n         \"size\": 10001,\n         \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n      }\n   ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json"}}, "requestID": "805a31e6-0fed-433b-b393-f463c6881334", "eventID": "1aef3588-ae84-4f1f-9276-8ec94ee6a7e9", "readOnly": false, "resources": [{"accountId": "111111111111", "ARN": "arn:aws:ecr:eu-central-1:1111111111111:repository/devsecops/cat_dog_server"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}

Source: GitHub | Version: 2