✄𐘗
text code block:
✄𐘗from logs-aws.cloudtrail-* metadata _id, _version, _index
| where event.dataset == "aws.cloudtrail"
    and event.provider == "iam.amazonaws.com"
    and event.action == "CreateAccessKey"
    and event.outcome == "success"
    and user.name != user.target.name
| keep
    @timestamp,
    cloud.account.id,
    cloud.region,
    event.provider,
    event.action,
    event.outcome,
    event.dataset,
    user.name,
    source.address,
    source.ip,
    user.target.name,
    user_agent.original,
    aws.cloudtrail.request_parameters,
    aws.cloudtrail.response_elements,
    aws.cloudtrail.user_identity.arn,
    aws.cloudtrail.user_identity.type,
    aws.cloudtrail.user_identity.access_key_id,
    source.geo.*,
    _id,
    _version,
    _index