✄𐘗
text code block:
✄𐘗from logs-aws.cloudtrail-*
| where KQL("""data_stream.dataset: "aws.cloudtrail" and event.provider: "sts.amazonaws.com" and event.action: "GetCallerIdentity" and event.outcome: "success" and not aws.cloudtrail.user_identity.type: "AssumedRole" and source.as.organization.name: * and not user.name: vault-oidc-*""")
  and source.ip is not null
  and not source.as.organization.name in (
    "Amazon.com, Inc.",
    "AMAZON-02",
    "AMAZON-AES",
    "Google LLC",
    "Microsoft Corporation",
    "Verizon Business",
    "AT&T Enterprises, LLC"
  )
| stats
    Esql.aws_cloudtrail_user_identity_arn_count_distinct = count_distinct(aws.cloudtrail.user_identity.arn),
    Esql.user_name_count_distinct = count_distinct(user.name),
    Esql.user_name_values = values(user.name),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.aws_cloudtrail_user_identity_arn_values = values(aws.cloudtrail.user_identity.arn)
  by source.ip, source.as.organization.name
| where Esql.user_name_count_distinct >= 3
| keep
    Esql.user_name_count_distinct,
    Esql.aws_cloudtrail_user_identity_arn_count_distinct,
    source.ip,
    source.as.organization.name,
    Esql.user_name_values,
    Esql.user_agent_original_values,
    Esql.aws_cloudtrail_user_identity_arn_values