name: siem-aws-cloudtrail
backend: ELK
description: AWS CloudTrail logs with enhanced field mapping

fields:
  # === Core Timestamp Fields ===
  - name: "@timestamp"
    type: date
    description: Event timestamp in ISO format
    is_key_field: false

  - name: eventTime
    type: keyword
    description: AWS CloudTrail event time
    is_key_field: false

  # === Event Identification ===
  - name: eventID
    type: keyword
    description: Unique CloudTrail event ID (UUID)
    is_key_field: true

  - name: eventName
    type: keyword
    description: AWS API action name (CreateUser, RunInstances, AssumeRole, etc.)
    is_key_field: true

  - name: eventSource
    type: keyword
    description: Event source (ec2.amazonaws.com, iam.amazonaws.com, s3.amazonaws.com, sts.amazonaws.com)
    is_key_field: true

  - name: eventType
    type: keyword
    description: Event type (AwsApiCall, AwsServiceEvent, AwsConsoleAction)
    is_key_field: false

  - name: eventVersion
    type: keyword
    description: CloudTrail event version (e.g., 1.08)
    is_key_field: false

  # === ECS Event Fields ===
  - name: event.dataset
    type: keyword
    description: Dataset source (aws.cloudtrail)
    is_key_field: false

  - name: event.module
    type: keyword
    description: Module (cloudtrail)
    is_key_field: false

  - name: event.action
    type: keyword
    description: API action name (same as eventName for CloudTrail)
    is_key_field: true

  - name: event.category
    type: keyword
    description: Event category (iam, cloud_infrastructure, cloud_storage, authentication)
    is_key_field: true

  - name: event.outcome
    type: keyword
    description: Event result (success, failure)
    is_key_field: true

  - name: event.risk_score
    type: long
    description: Risk score (20-100), based on operation severity
    is_key_field: false

  # === AWS Account & Region ===
  - name: cloud.provider
    type: keyword
    description: Cloud provider identifier (aws)
    is_key_field: false

  - name: cloud.service.name
    type: keyword
    description: AWS service name (ec2, iam, s3, sts, cloudtrail)
    is_key_field: true

  - name: cloud.region
    type: keyword
    description: AWS region (us-east-1, us-west-2, eu-west-1, ap-northeast-1)
    is_key_field: true

  - name: cloud.account.id
    type: keyword
    description: AWS account ID (12-digit number)
    is_key_field: true

  - name: awsRegion
    type: keyword
    description: AWS region (alternate field, same as cloud.region)
    is_key_field: false

  - name: recipientAccountId
    type: keyword
    description: Target AWS account ID for the API call
    is_key_field: true

  # === Request Identification ===
  - name: requestID
    type: keyword
    description: AWS request ID (UUID)
    is_key_field: true

  - name: sourceIPAddress
    type: ip
    description: Source IP address of the API caller
    is_key_field: true

  - name: userAgent
    type: text
    description: User agent string (aws-cli, Terraform, boto3, etc.)
    is_key_field: false

  # === User Identity ===
  - name: userIdentity
    type: object
    description: User identity object containing type, principalId, arn, accountId, userName, accessKeyId
    is_key_field: false

  - name: userIdentity.type
    type: keyword
    description: User identity type (IAMUser, IAMRole, AssumedRole, RootUser)
    is_key_field: true

  - name: userIdentity.principalId
    type: keyword
    description: Principal ID (AIDAI... for users, AIDA... for roles)
    is_key_field: true

  - name: userIdentity.arn
    type: keyword
    description: User ARN (arn:aws:iam::123456789012:user/username)
    is_key_field: false

  - name: userIdentity.accountId
    type: keyword
    description: AWS account ID of the user
    is_key_field: true

  - name: userIdentity.userName
    type: keyword
    description: IAM user name
    is_key_field: true

  - name: userIdentity.accessKeyId
    type: keyword
    description: Access key ID (AKIA... for long-term keys, ASIA... for temp keys)
    is_key_field: true

  # === Request Parameters ===
  - name: requestParameters
    type: object
    description: Request parameters object (varies by eventName)
    is_key_field: false

  # === Response Elements ===
  - name: responseElements
    type: object
    description: Response elements object (only present on successful calls)
    is_key_field: false

  # === Error Information ===
  - name: errorCode
    type: keyword
    description: Error code (AccessDenied, InvalidParameterValue, UnauthorizedOperation, InsufficientPermissions)
    is_key_field: true

  - name: errorMessage
    type: text
    description: Error message (detailed error explanation)
    is_key_field: false

  # === Operation Flags ===
  - name: readOnly
    type: boolean
    description: Flag indicating if operation is read-only (read operations don't modify resources)
    is_key_field: true

  # === Message and Logging ===
  - name: message
    type: text
    description: Human-readable message about the event
    is_key_field: false

  - name: log.level
    type: keyword
    description: Log severity level (info, warning, error)
    is_key_field: false
