Filebeat AWS CloudTrail eventName overwritten by eventCategory during ingest

[adamkrieger]

Issue: Where ECS = destination elasticsearch record and json = CloudTrail payload being ingested. By default, the pipeline used to process CloudTrail logs will overwrite ECS event.action with json eventCategory where ECS event.action should be json eventName. ECS event.category is also not written to as a result.

I believe this is the line causing the issue:

beats/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml

Line 95 in 6106aa7

field: "event.action"

Example CloudTrail Payload:

{"awsRegion":"us-east-1","eventCategory":"Management","eventID":"REDACTED","eventName":"DescribeConfigurationRecorders","eventSource":"config.amazonaws.com","eventTime":"REDACTED","eventType":"AwsApiCall","eventVersion":"1.07","managementEvent":true,"readOnly":true,"recipientAccountId":"REDACTED","requestID":"REDACTED","requestParameters":null,"responseElements":null,"sourceIPAddress":"REDACTED","userAgent":"REDACTED","userIdentity":{"accessKeyId":"REDACTED","accountId":"REDACTED","arn":"arn:aws:iam::REDACTED:user/REDACTED","principalId":"REDACTED","sessionContext":{"attributes":{"creationDate":"REDACTED","mfaAuthenticated":"true"},"sessionIssuer":{},"webIdFederationData":{}},"type":"IAMUser","userName":"REDACTED"}}

Results in Elasticsearch ECS fields:

event.action = Management
event.category NOT SET

Expected:

event.action = DescribeConfigurationRecorders
event.category = Management

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[leehinman]

Because ECS specifies a list of accepted values. I stored eventCategory in a new custom field, see #22805

[adamkrieger]

Ah great, even better.