✄𐘗
text code block:
✄𐘗from logs-aws.cloudtrail-*
| where KQL("""event.provider: "ec2.amazonaws.com" and event.action: "DescribeInstanceAttribute" and event.outcome: "success" and aws.cloudtrail.flattened.request_parameters.attribute: "userData" and source.ip: * and source.as.organization.name: * and not user.name: (*CrowdStrikeCSPMReader* or *OrcaSecurityRole* or *AikidoSecurityRole* or *streamsec-*) and not aws.cloudtrail.user_identity.invoked_by: ("AWS Internal" or "cloudformation.amazonaws.com" or "aidevops.amazonaws.com" or "elasticmapreduce.amazonaws.com" or "aiops.amazonaws.com")""")
  and not (
    user_agent.original like "*Terraform*"
    and source.as.organization.name in (
      "Amazon.com, Inc.",
      "Google LLC",
      "Microsoft Corporation",
      "Verizon Business",
      "AT&T Enterprises, LLC"
    )
  )
| grok aws.cloudtrail.request_parameters """instanceId=(?<Esql.instance_id>[^,}\]]+)"""
| where Esql.instance_id is not null
| stats
    Esql.count_distinct_instance_id = count_distinct(Esql.instance_id),
    Esql.aws_request_parameters_values = values(aws.cloudtrail.request_parameters),
    Esql.user_agent_values = values(user_agent.original)
  by
    data_stream.namespace,
    aws.cloudtrail.user_identity.arn,
    aws.cloudtrail.user_identity.type,
    source.as.organization.name,
    source.ip, 
	source.`as`.number
| where Esql.count_distinct_instance_id > 20
| keep
    Esql.count_distinct_instance_id,
    data_stream.namespace,
    aws.cloudtrail.user_identity.arn,
    aws.cloudtrail.user_identity.type,
    source.ip,
	source.`as`.number,
    source.as.organization.name,
    Esql.aws_request_parameters_values,
    Esql.user_agent_values