Hi all,
I am looking to try and figure out how to compose a query that has information I need in two distinct sourcetypes with potentially no shared field. The query is to figure out who launched a AWS EC2 instance that is not tagged correctly.
I can find the instance launched details using this query.
index=* sourcetype="ec2-audit" earliest_time=-1h instance_id=* NOT tag_Service="Self"
| where isnull(tag_Opco) OR isnull(tag_Environment) OR isnull(tag_Cartesis) OR isnull(tag_Requester) OR isnull(tag_Service) OR isnull(tag_Product) OR isnull(tag_Role) OR isnull(tag_Username) OR isnull(tag_GST)
| dedup instance_id
| table index status type instance_id tag_Name tag_Environment tag_Service tag_Opco tag_Cartesis tag_Product tag_Role tag_Requester tag_Username tag_GST
The problem is this source type does not contain any information around the user who is logged into the AWS console, and subsequently launched the instance. That is found using this querying index=cloudtrail sourcetype=aws-cloudtrail, which has a object userIdentity.arn which matches the person who launched the instance.
So I know this is quite vague, but any is greatly appreciated
Julian
