Tools · AWS detection and investigation · 23 / 24
CloudTrail Lake: eventSource is the service
eventSource names the AWS service API on that row, such as the EC2 or IAM endpoint the call used. It is not the account and not the person. Write it beside eventName.
The source is the API family
eventSource is a service endpoint string on the row. It says which service received the call. It does not say which account owns the resource, and it does not say who typed the command.
Two rows can share an eventSource and be different calls. The event name distinguishes them. The source alone is the service.
Do not swap it with identity fields
The caller is on the identity fields. The account is on the account fields. eventSource is neither. A sentence that says “EC2 did this” because the source contains ec2 is describing the service API, not an actor.
If eventSource is missing, write “eventSource not on this row.” Do not fill it from the event name.
What to file
File eventSource, eventName, and eventID. When you say which service, quote eventSource. When you say who, quote the identity field you actually have.
Worked case: an EC2 source read as the actor
A lab row has eventSource ec2.amazonaws.com and eventName DescribeInstances. The identity is role lab-read in account 111122223333. A draft says EC2 listed the instances, as if the service were the caller.
The note quotes ec2.amazonaws.com as the service API and lab-read as the identity on the row. The service string is not the actor. The call is DescribeInstances against that API, by that role.
eventSource: ec2.amazonaws.com eventName: DescribeInstances identity: role lab-read account: 111122223333 write: service API and the role not: EC2 was the actor
Diagram
The service API and the caller
eventSource does not replace the identity.
Is. The service endpoint on the row
Example. ec2.amazonaws.com
Does not. Name the person or the role
Are. Who the row says called
Example. role lab-read
Missing. Do not substitute the service string
Check yourself
1. eventSource is ec2.amazonaws.com. What does that name?
2. The identity field is empty and eventSource is present. Who do you name as the caller?
3. Two rows share ec2.amazonaws.com and have different event names. What do they share?