✄𐘗
text code block:
✄𐘗FROM logs-aws.cloudtrail-*
| WHERE event.provider == "ecs.amazonaws.com"
    AND event.action IN ("RegisterTaskDefinition", "RunTask", "StartTask", "CreateService")
| EVAL Esql.miner_register = CASE(
        event.action == "RegisterTaskDefinition"
            AND (aws.cloudtrail.request_parameters RLIKE """.*image=(docker.io|index.docker.io|ghcr.io|quay.io|public.ecr.aws)/.*"""
                OR aws.cloudtrail.request_parameters RLIKE """.*image=[-a-zA-Z0-9_]+(/|[,} :]).*""")
            AND aws.cloudtrail.request_parameters RLIKE """.*cpu=(8192|16384)[,} ].*""", 1, 0),
    Esql.task_run = CASE(event.action IN ("RunTask", "StartTask", "CreateService"), 1, 0)
| STATS Esql.miner_register_sum = SUM(Esql.miner_register), Esql.task_run_sum = SUM(Esql.task_run), Esql.event_count = COUNT(*),
        Esql.cloud_region_count_distinct = COUNT_DISTINCT(cloud.region), Esql.cloud_region_values = VALUES(cloud.region),
        Esql.event_action_values = VALUES(event.action), Esql.source_ip_values = VALUES(source.ip),
        Esql.source_as_number_values = VALUES(source.as.number), Esql.user_agent_original_values = VALUES(user_agent.original),
        Esql.cloud_account_id_values = VALUES(cloud.account.id), Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),
        Esql.timestamp_min = MIN(@timestamp), Esql.timestamp_max = MAX(@timestamp)
        BY aws.cloudtrail.user_identity.arn
| WHERE Esql.miner_register_sum >= 1 AND Esql.task_run_sum >= 1
| KEEP aws.*, Esql.aws_cloudtrail_user_identity_type_values, Esql.miner_register_sum, Esql.task_run_sum, Esql.event_count, Esql.cloud_region_count_distinct, Esql.cloud_region_values, Esql.event_action_values, Esql.source_ip_values, Esql.source_as_number_values, Esql.user_agent_original_values, Esql.cloud_account_id_values, Esql.timestamp_min, Esql.timestamp_max