ExtractIndicators-CloudLogging
This script will extract indicators from a given AWS CloudTrail or GCP Logging event.
python · Cloud Incident Response
Details
| ID | ExtractIndicators-CloudLogging |
|---|---|
| Language | python |
| From Version | 6.8.0 |
| Docker Image | demisto/bs4-tld:1.0.0.10133006 |
README
This script will extract indicators from a given AWS CloudTrail or GCP Logging event.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Cortex XSOAR Version | 6.8.0 |
Inputs
| Argument Name | Description |
|---|---|
| json_data | The event JSON or data. |
Outputs
| Path | Description | Type |
|---|---|---|
| CloudIndicators.arn | The ARN extracted from the event | Unknown |
| CloudIndicators.access_key_id | The access key ID extracted from the event | Unknown |
| CloudIndicators.resource_name | The resource name extracted from the event | Unknown |
| CloudIndicators.source_ip | The source ip extracted from the event | Unknown |
| CloudIndicators.username | The username extracted from the event | Unknown |
| CloudIndicators.event_name | The event name extracted from the event | Unknown |
| CloudIndicators.user_agent | The user agent extracted from the event | Unknown |
commonfields: id: ExtractIndicators-CloudLogging version: -1 name: ExtractIndicators-CloudLogging script: '' type: python tags: [] comment: This script will extract indicators from a given AWS CloudTrail or GCP Logging event. enabled: true args: - name: json_data required: true description: The event JSON or data. outputs: - contextPath: CloudIndicators.arn description: "The ARN extracted from the event." - contextPath: CloudIndicators.access_key_id description: "The access key ID extracted from the event." - contextPath: CloudIndicators.resource_name description: "The resource name extracted from the event." - contextPath: CloudIndicators.source_ip description: "The source ip extracted from the event." - contextPath: CloudIndicators.username description: "The username extracted from the event." - contextPath: CloudIndicators.event_name description: "The event name extracted from the event." - contextPath: CloudIndicators.user_agent description: "The user agent extracted from the event." scripttarget: 0 subtype: python3 dockerimage: demisto/bs4-tld:1.0.0.10133006 runas: DBotWeakRole fromversion: 6.8.0 tests: - No tests (auto formatted)