Stay organized with collections
Save and categorize content based on your preferences.
Change log for AWS_CONTROL_TOWER
Date
Changes
2024-03-17
Enhancement:
- Mapped "req.userIdentity.arn" and "req.userIdentity.userName" to "target.user.userid".
2023-01-04
Enhancement:
- Initialized variables to avoid replication of data in the For loop.
2022-12-15
Enhancement:
- Mapped 'metadata.vendor_name' to 'AWS'.
- Mapped 'metadata.product_name' to 'AWS Control Tower'.
- Mapped 'metadata.event_type' to 'USER_LOGIN' when 'eventName' is 'ConsoleLogin'.
- Mapped 'security_result.severity' to 'INFORMATIONAL' when 'eventName' is 'ConsoleLogin'.
2022-11-17
Enhancement:
- Mapped 'req.userIdentity.userName' and 'req.userIdentity.sessionContext.sessionIssuer.userName' to 'target.user.id'.
- Mapped 'ConsoleLogin:Success' to 'security_result.action'.
- Mapped port information from 'sourceIPAddress' to 'principal.port'.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThe change log details enhancements made to AWS Control Tower, including new variable initializations.\u003c/p\u003e\n"],["\u003cp\u003eSeveral mappings were implemented, such as 'req.userIdentity.arn' and 'req.userIdentity.userName' to 'target.user.userid'.\u003c/p\u003e\n"],["\u003cp\u003eVarious metadata and security results were mapped, including 'metadata.vendor_name' to 'AWS' and 'security_result.severity' to 'INFORMATIONAL' for ConsoleLogin events.\u003c/p\u003e\n"],["\u003cp\u003eUser and session information are being mapped to new keys, including 'req.userIdentity.userName' and 'req.userIdentity.sessionContext.sessionIssuer.userName' being mapped to 'target.user.id'.\u003c/p\u003e\n"],["\u003cp\u003eA new parser was implemented on October 31, 2022, that changed some of the mapped data.\u003c/p\u003e\n"]]],[],null,["# Change log for AWS_CONTROL_TOWER\n================================"]]
