aws:cloudtrail GetCallerIdentity
GetCallerIdentity
- Log source
- AWS CloudTrail
- Host type
- AWS
- Tier, host type
- Minimum
- Techniques
- 2
- Rules depending on it
- Elastic 6, Microsoft Sentinel 1
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| AWS account | Minimum |
Techniques it helps detect
Rules that depend on it
Elastic 6
- AWS Bedrock API Key Phantom User Activity Outside Bedrock
- AWS Discovery API Calls from VPN ASN for the First Time by Identity
- AWS EC2 Role GetCallerIdentity from New Source AS Organization
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity
- AWS Rare Source AS Organization Activity
- AWS STS GetCallerIdentity API Called for the First Time