External DocumentationTo learn more, visit the Lacework documentation.
Parameters
| Parameter | Description |
|---|---|
| End Time | Query for changed files until given timestamp. |
| Start Time | Query for changed files since given timestamp. |
Example Output
{
"data": [
{
"endTime": "2022-03-18T01:00:00.000Z",
"eventCount": 7738,
"eventType": "CloudTrailDefaultAlert",
"id": 438898,
"srcEvent": {
"awsRegion": "us-west-2",
"event": {
"additionalEventData": {
"AuthenticationMethod": "AuthHeader",
"CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"SignatureVersion": "SigV4",
"bytesTransferredIn": 0,
"bytesTransferredOut": 137,
"x-amz-id-2": "wl+gKI0I80T1CIBzz8d96nX5XcesTU/eIeo8SwdNqmSH2ZYFZssPmlqNhJJnhvewgefx6Babcqc="
},
"awsRegion": "us-west-2",
"eventCategory": "Management",
"eventID": "1dddd61c-7608-87d8-b9f8-4a52495bdbb1",
"eventName": "GetBucketLocation",
"eventSource": "s3.amazonaws.com",
"eventTime": "2022-03-18T00:04:08Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "631668038012",
"requestID": "SRZY6EVTR8Q3ADSJ",
"requestParameters": {
"Host": "s3.us-west-2.amazonaws.com",
"bucketName": "redhat-k8-crio-bucket",
"location": ""
},
"resources": [
{
"ARN": "arn:aws:s3:::redhat-k8-crio-bucket",
"accountId": "631668038012",
"type": "Aws::s3::bucket"
}
],
"sourceIPAddress": "36.223.225.183",
"tlsDetails": {
"cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"clientProvidedHostHeader": "s3.us-west-2.amazonaws.com",
"tlsVersion": "TLSv1.2"
},
"userAgent": "[aws-sdk-go/1.37.0 (go1.15.8; linux; amd64)]",
"userIdentity": {
"accessKeyId": "ABCDEFGHIJKLMNOPQRST",
"accountId": "631668038012",
"arn": "arn:aws:sts::631668038012:assumed-role/masters.redhatk8crio.k8s.local/i-06443e34ddc641957",
"principalId": "ABCDEFGHIJKL123456789",
"sessionContext": {
"attributes": {
"creationDate": "2022-03-17T23:58:00Z",
"mfaAuthenticated": "false"
},
"ec2RoleDelivery": "2.0",
"sessionIssuer": {
"accountId": "631668038012",
"arn": "arn:aws:iam::631668038012:role/masters.redhatk8crio.k8s.local",
"principalId": "ABCDEFGHIJKL123456789",
"type": "Role",
"userName": "masters.redhatk8crio.k8s.local"
},
"webIdFederationData": {}
},
"type": "Assumedrole"
}
},
"eventName": "GetBucketLocation",
"eventSource": "s3.amazonaws.com",
"is_assumed_role": true,
"principalId": "ABCDEFGHIJKL123456789",
"recipientAccountId": "631668038012",
"sourceIPAddress": "36.223.225.183",
"userIdentity": {
"accessKeyId": "ABCDEFGHIJKLMNOPQRST",
"accountId": "631668038012",
"arn": "arn:aws:sts::631668038012:assumed-role/masters.redhatk8crio.k8s.local/i-06443e34ddc641957",
"principalId": "ABCDEFGHIJKL123456789",
"sessionContext": {
"attributes": {
"creationDate": "2022-03-17T23:58:00Z",
"mfaAuthenticated": "false"
},
"ec2RoleDelivery": "2.0",
"sessionIssuer": {
"accountId": "631668038012",
"arn": "arn:aws:iam::631668038012:role/masters.redhatk8crio.k8s.local",
"principalId": "ABCDEFGHIJKL123456789",
"type": "Role",
"userName": "masters.redhatk8crio.k8s.local"
},
"webIdFederationData": {}
},
"type": "Assumedrole"
},
"userIdentityAccount": "631668038012",
"userIdentityName": "masters.redhatk8crio.k8s.local",
"userIdentityType": "AssumedRole",
"username": "AssumedRole/631668038012:masters.redhatk8crio.k8s.local"
},
"srcType": "AwsResource",
"startTime": "2022-03-18T00:00:00.000Z"
},
{
"endTime": "2022-03-18T01:00:00.000Z",
"eventCount": 7738,
"eventType": "CloudTrailDefaultAlert",
"id": 438898,
"srcEvent": {
"awsRegion": "us-west-2",
"event": {
"additionalEventData": {
"AuthenticationMethod": "AuthHeader",
"CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"SignatureVersion": "SigV4",
"bytesTransferredIn": 0,
"bytesTransferredOut": 137,
"x-amz-id-2": "hhxqxS6lksuIoI/E8eZqZ1xg+yqLSVwoXBgFb3doT0+e3QJzoDyGuQ6RqVkL8zjyhVBKhbQGC9E="
},
"awsRegion": "us-west-2",
"eventCategory": "Management",
"eventID": "1338a37d-4309-44bb-9f68-30c39ce152b0",
"eventName": "GetBucketLocation",
"eventSource": "s3.amazonaws.com",
"eventTime": "2022-03-18T00:17:27Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "631668038012",
"requestID": "T7SB5GS78Q8ZA4KV",
"requestParameters": {
"Host": "s3.us-west-2.amazonaws.com",
"bucketName": "asset-mgt-dev-697",
"location": ""
},
"resources": [
{
"ARN": "arn:aws:s3:::asset-mgt-dev-697",
"accountId": "631668038012",
"type": "Aws::s3::bucket"
}
],
"sourceIPAddress": "10.0.198.115",
"tlsDetails": {
"cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"clientProvidedHostHeader": "s3.us-west-2.amazonaws.com",
"tlsVersion": "TLSv1.2"
},
"userAgent": "[aws-sdk-go/1.40.53 (go1.16; linux; amd64)]",
"userIdentity": {
"accessKeyId": "ABCDEFGHIJKLMNOPQRST",
"accountId": "631668038012",
"arn": "arn:aws:iam::631668038012:user/user1-7nsnk-managed-velero-operator-iam-credentia-dr7ss",
"principalId": "ABCDEFGHIJKL123456789",
"type": "Iamuser",
"userName": "user1-7nsnk-managed-velero-operator-iam-credentia-dr7ss"
},
"vpcEndpointId": "vpce-0b01b13fbbcec47fa"
},
"eventName": "GetBucketLocation",
"eventSource": "s3.amazonaws.com",
"is_assumed_role": false,
"principalId": "ABCDEFGHIJKL123456789",
"recipientAccountId": "631668038012",
"sourceIPAddress": "10.0.198.115",
"userIdentity": {
"accessKeyId": "ABCDEFGHIJKLMNOPQRST",
"accountId": "631668038012",
"arn": "arn:aws:iam::631668038012:user/user1-7nsnk-managed-velero-operator-iam-credentia-dr7ss",
"principalId": "ABCDEFGHIJKL123456789",
"type": "Iamuser",
"userName": "user1-7nsnk-managed-velero-operator-iam-credentia-dr7ss"
},
"userIdentityAccount": "631668038012",
"userIdentityType": "IAMUser",
"username": "IAMUser/631668038012:user1-7nsnk-managed-velero-operator-iam-credentia-dr7ss"
},
"srcType": "AwsResource",
"startTime": "2022-03-18T00:00:00.000Z"
}
]
}
Workflow Library Example
Search Events with Lacework and Send Results Via Email