Dashboard: CloudTrail Log Root User Activity Report

This dashboard contains 1 card, 2 inputs and 1 table.

Usage

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/tailpipe-mod-aws-cloudtrail-log-detections

Start the Powerpipe server:

powerpipe server

Open http://localhost:9033 in your browser and select CloudTrail Log Root User Activity Report dashboard.

You could also snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe dashboard run aws_cloudtrail_log_detections.dashboard.root_user_activity_report --share

Queries

This dashboard uses the the following queries:

select
  epoch_ms(tp_timestamp) as timestamp,
  string_split(event_source, '.')[1] || ':' || event_name as operation,
  user_identity.arn as actor,
  tp_source_ip as source_ip,
  tp_index::varchar as account_id,
  aws_region as region,
  tp_id as source_id,
  *
from
  aws_cloudtrail_log
where
  ($1 = 'true' or ($1 = 'false' and read_only = false))
  and recipient_account_id in $2
  and user_identity.type = 'Root'
order by
  timestamp desc
limit 10000;

Dashboard: CloudTrail Log Root User Activity Report

Usage

Queries

Tags