KQL Search

Query Details

AWS Cloud Trail AWS User MFA Modified

Query

AWSCloudTrail
| where EventName in ("CreateVirtualMFADevice", "EnableMFADevice", "DeleteVirtualMFADevice", "DeactivateMFADevice")
| extend
    UserName = tostring(todynamic(RequestParameters)["userName"]),
    Device = tostring(todynamic(RequestParameters)["serialNumber"])
| invoke AWSIdentityRole()
| project
    TimeGenerated,
    UserIdentityType,
    Identity,
    ActorRole,
    UserIdentityAccountId,
    UserIdentityAccountName,
    RecipientAccountId,
    RecipientAccountName,
    AWSRegion,
    SessionCreationDate,
    UserIdentityPrincipalid,
    UserIdentityArn,
    SourceIpAddress,
    EventSource,
    EventTypeName,
    EventName,
    ManagementEvent,
    ReadOnly,
    ErrorCode,
    ErrorMessage,
    UserName,
    Device,
    RequestParameters,
    ResponseElements,
    Resources,
    SessionMfaAuthenticated,
    UserAgent,
    AwsEventId

Explanation

This KQL query is designed to analyze AWS CloudTrail logs, specifically focusing on events related to Multi-Factor Authentication (MFA) devices. Here's a simplified breakdown of what the query does:

  1. Data Source: It starts by accessing the AWSCloudTrail logs.

  2. Filter Events: It filters the logs to only include events where the EventName is one of the following: "CreateVirtualMFADevice", "EnableMFADevice", "DeleteVirtualMFADevice", or "DeactivateMFADevice". These events are related to the creation, enabling, deletion, or deactivation of virtual MFA devices.

  3. Extract Information: The query extracts additional details from the RequestParameters field:

    • UserName: The name of the user involved in the event.
    • Device: The serial number of the MFA device involved.

  4. Invoke Function: It uses the AWSIdentityRole() function to enrich the data with identity-related information.

  5. Select Columns: Finally, it selects and displays a wide range of columns, including:

    • TimeGenerated: The time the event was logged.
    • UserIdentityType, Identity, ActorRole, etc.: Various details about the user identity and roles.
    • AWSRegion: The AWS region where the event occurred.
    • EventSource, EventTypeName, EventName: Information about the event type and source.
    • ErrorCode, ErrorMessage: Any error details if applicable.
    • UserName, Device: The extracted user and device information.
    • Other metadata fields related to the event.

In summary, this query is used to monitor and analyze activities related to MFA devices in AWS, providing detailed information about each relevant event.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: March 11, 2024

Tables

AWSCloudTrail

Keywords

AWSCloudTrailEventNameUserNameDeviceAWSIdentityRoleTimeGeneratedUserIdentityTypeIdentityActorRoleUserIdentityAccountIdUserIdentityAccountNameRecipientAccountIdRecipientAccountNameAWSRegionSessionCreationDateUserIdentityPrincipalidUserIdentityArnSourceIpAddressEventSourceEventTypeNameManagementEventReadOnlyErrorCodeErrorMessageRequestParametersResponseElementsResourcesSessionMfaAuthenticatedUserAgentAwsEventId

Operators

AWSCloudTrailwhereinextendtostringtodynamicinvokeAWSIdentityRoleproject

Actions

GitHub