from logs-aws.cloudtrail-* metadata _id, _version, _index

// Filter for successful snapshot modifications
| where
  event.provider == "ec2.amazonaws.com"
  and event.action == "ModifySnapshotAttribute"
  and event.outcome == "success"

// dissect parameters to extract key fields
| dissect aws.cloudtrail.request_parameters
    "{%{?snapshotId}=%{Esql.aws_cloudtrail_request_parameters_snapshot_id},%{?attributeType}=%{Esql.aws_cloudtrail_request_parameters_attribute_type},%{?createVolumePermission}={%{Esql.aws_cloudtrail_request_parameters_operation_type}={%{?items}=[{%{?userId}=%{Esql_priv.aws_cloudtrail_request_parameters_user_id}}]}}}"

// Match on snapshot permission **removal**
| where Esql.aws_cloudtrail_request_parameters_operation_type == "remove"

// keep ECS and derived fields
| keep
  @timestamp,
  aws.cloudtrail.user_identity.arn,
  cloud.account.id,
  event.action,
  Esql.aws_cloudtrail_request_parameters_snapshot_id,
  Esql.aws_cloudtrail_request_parameters_attribute_type,
  Esql.aws_cloudtrail_request_parameters_operation_type,
  Esql_priv.aws_cloudtrail_request_parameters_user_id,
  source.address