---
title: "CloudTrail Audit SQS collector"
canonical: "https://docs.devo.com/space/latest/612859906/CloudTrail%20Audit%20SQS%20collector"
format: markdown
---
> Macro (toc)

## Purpose

An analyst wants to **detect malicious behavior in AWS**.  Using **the CloudTrail SQS collector**, the analyst will **find every management and data action taken by AWS principals**.  As a result, the analyst will revoke the malicious principal’s role, preventing them from disabling cloud services.

## Example tables

| **Table** | **Description** |
| --- | --- |
| [cloud.aws.cloudtrail](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94661084) | Actions taken in all AWS resources enabled in CloudTrail. |
|  | Each AWS service has a fourth level table, such as cloud.aws.cloudtrail.ec2 |
| cloud.aws | Includes CloudTrail and non-CloudTrail AWS logs. |
| auth.all | Authentication logs, including cloud.aws.cloudtrail.events and cloud.aws.cloudtrail.signin. |

## Authorize It

1. [Authorize SQS Data Access](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1098121229).
2. [Add data to the S3 bucket](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html).
  1. If you have an AWS organization, [create a trail for the organization](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-prepare.html).  Otherwise, [create a trail for an AWS account](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html#creating-a-trail-in-the-console).  “Quick create” is not recommended.
  2. Name the trail `Devo`.
  3. Edit the trail.
  4. Use the existing bucket created in Step 1.
    
  5. Disable SSE-KMS.  If you require SSE-KMS, the [key resource must be added to the cross account role](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html) you crated for Devo.
  6. On the next screen, enable events.
    1. Management events are supported by Devo and recommended for detection of unauthorized changes to AWS resources.
    2. Data events are supported by Devo and recommended for detection of unauthorized access or modification of resources, including S3 data (`cloud.aws.cloudtrail.s3`) and SNS notifications (`cloud.aws.cloudtrail.sns`).
    3. Insights events are supported by Devo and are recommended for detecting malicious API activity and API service degradation problems (`cloud.aws.cloudtrail.insights`).
  7. Create the trail.
    

## Run It

In the **Cloud Collector App**, [create an SQS Collector instance](https://docs.devo.com/space/latest/409305131/Catalog#Create-an-instance).  **Remove **the default collector parameters and insert this parameters template, replacing the values enclosed in `< >`.

```
{
  "inputs": {
    "sqs_collector": {
      "id": "<FIVE_UNIQUE_DIGITS>",
      "services": {
        "aws_sqs_cloudtrail": {}
      },
      "credentials": {
              "aws_cross_account_role": "arn:<PARTITION>:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>",
              "aws_external_id": "<EXTERNAL_ID>"
      },
      "region": "<REGION>",
      "base_url": "https://sqs.<REGION>.amazonaws.com/<YOUR_AWS_ACCOUNT_NUMBER>/<QUEUE_NAME>"
    }
  }
}
```

## Secure It

Combine the CloudTrail service with the [GuardDuty service](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1097990169) to get threat intelligence from AWS.

The data is in the `cloud.aws.cloudtrail.*` tables.  The fourth level of the tag is the AWS [service](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/).

Use the [AWS](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#CLOUD%2FAWS) and [authentication](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#AUTH) queries from the library.

### S3 *Storage*

```
//Investigating unauthorized deletion
//Determine number of resources deleted by each host
//A host with an unusual number of deletions may be compromised
from cloud.aws.cloudtrail.s3
  where eventName = "DeleteObject"
  group by requestParameters_Host
  select collectdistinct(jqeval(jqcompile(".[0].ARN"),resources)) as resources,
  length(resources) as number_deleted
```

![image-20250117-184048.png](media://88d6b0c8-b4c2-4bc0-9c30-8b328b508a6b)

### IAM* Access*

```
/*
A compromised Kubernetes principal has been taking action in 
AWS Identity and Access Management.  Get a list of the actions taken.
*/

from cloud.aws.cloudtrail.iam
  where userIdentity_principalId = "EXAMPLE:EKS"
  group by eventName
```

![image-20250117-210908.png](media://fb84c14e-bbfc-41de-93a4-5f0c25a521aa)

### KMS* Cryptography*

```
/* 
Check for unauthorized principals that have used decryption.  
Determine their identity types and if they have used a root identity.
*/

from cloud.aws.cloudtrail.kms
  where eventName = "Decrypt"
  group by userIdentity_principalId
  select collectdistinct(userIdentity_type) as userIdentity_types,
  `in`("Root",userIdentity_types) as is_root
```

![image-20250117-212228.png](media://8f7393aa-92b4-4b29-8287-f48d6819fa6a)

### EC2 *Compute*

```
/*
Yesterday, some compute principals were 
removed without authorization.  Determine which
compute principals stopped generating logs,
so they can be investigated to see if they were attacked.
*/

from cloud.aws.cloudtrail.ec2
group by userIdentity_principalId

select last(eventdate) as last_seen
where today()-1d<last_seen<today()
```

![image-20250117-212928.png](media://7141951f-4e86-403d-8874-043edf4fe0b0)


### CloudTrail

```
/*
A malicious user has disabled CloudTrail 
to hide their subsequent activity.
Identify the user.
*/

from cloud.aws.cloudtrail.cloudtrail
  where eventName = "StopLogging"
```

![image-20250117-213857.png](media://f1c964b5-ccc7-4171-80bf-73e29d379c5a)

## Monitor It

Create an **[inactivity alert](https://docs.devo.com/space/latest/95126785/Inactivity+alert)**** **to detect interruptions of transfer of data from the source to the SQS queue using the query

```
from cloud.aws.cloudtrail
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id
```

Set the inactivity alert to keep track of the `collector_id`.