{"eventVersion": "1.09", "eventTime": "2026-01-15T08:00:12Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeInstances", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "responseElements": null, "requestParameters": {"instancesSet": {}, "filterSet": {}}}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:02:33Z", "eventSource": "s3.amazonaws.com", "eventName": "GetObject", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.25", "userAgent": "aws-sdk-python/1.34.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/app-backend", "accountId": "123456789012", "userName": "app-backend"}, "requestParameters": {"bucketName": "corp-app-assets", "key": "images/logo.png"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:05:00Z", "eventSource": "monitoring.amazonaws.com", "eventName": "PutMetricData", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.20", "userAgent": "aws-sdk-java/2.20.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/monitoring-agent", "accountId": "123456789012", "userName": "monitoring-agent"}, "requestParameters": {"namespace": "Custom/AppMetrics"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:08:15Z", "eventSource": "elasticloadbalancing.amazonaws.com", "eventName": "DescribeTargetHealth", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.20", "userAgent": "aws-sdk-java/2.20.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/monitoring-agent", "accountId": "123456789012", "userName": "monitoring-agent"}, "requestParameters": {"targetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/abc123"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:10:22Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeSecurityGroups", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"securityGroupSet": {}, "filterSet": {}}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:12:00Z", "eventSource": "logs.amazonaws.com", "eventName": "CreateLogStream", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.15", "userAgent": "aws-sdk-python/1.34.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/app-backend", "accountId": "123456789012", "userName": "app-backend"}, "requestParameters": {"logGroupName": "/aws/app/production", "logStreamName": "i-0abc123def456789/application.log"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:15:00Z", "eventSource": "s3.amazonaws.com", "eventName": "PutObject", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"bucketName": "corp-deploy-artifacts", "key": "releases/v2.4.1/app.zip"}, "responseElements": {"x-amz-server-side-encryption": "AES256"}}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:18:44Z", "eventSource": "ec2.amazonaws.com", "eventName": "RunInstances", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"instanceType": "t3.medium", "imageId": "ami-0abc123def456789a", "minCount": 1, "maxCount": 1}, "responseElements": {"instancesSet": {"items": [{"instanceId": "i-0new123instance456"}]}}}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:20:00Z", "eventSource": "monitoring.amazonaws.com", "eventName": "PutMetricData", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.20", "userAgent": "aws-sdk-java/2.20.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/monitoring-agent", "accountId": "123456789012", "userName": "monitoring-agent"}, "requestParameters": {"namespace": "Custom/AppMetrics"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:22:15Z", "eventSource": "iam.amazonaws.com", "eventName": "CreateAccessKey", "awsRegion": "us-east-1", "sourceIPAddress": "198.51.100.77", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/jdoe", "accountId": "123456789012", "userName": "jdoe"}, "requestParameters": {"userName": "devops-jenkins"}, "responseElements": {"accessKey": {"accessKeyId": "AKIA5EXAMPLE1234ABCD", "status": "Active", "userName": "devops-jenkins", "createDate": "2026-01-15T08:22:15Z"}}}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:23:00Z", "eventSource": "s3.amazonaws.com", "eventName": "GetObject", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.25", "userAgent": "aws-sdk-python/1.34.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/app-backend", "accountId": "123456789012", "userName": "app-backend"}, "requestParameters": {"bucketName": "corp-app-assets", "key": "config/app-settings.json"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:25:33Z", "eventSource": "s3.amazonaws.com", "eventName": "PutBucketPolicy", "awsRegion": "us-east-1", "sourceIPAddress": "198.51.100.77", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/jdoe", "accountId": "123456789012", "userName": "jdoe"}, "requestParameters": {"bucketName": "corp-sensitive-data", "bucketPolicy": {"Version": "2012-10-17", "Statement": [{"Sid": "PublicRead", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::corp-sensitive-data/*"}]}}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:27:00Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeInstances", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:28:44Z", "eventSource": "ec2.amazonaws.com", "eventName": "AuthorizeSecurityGroupIngress", "awsRegion": "us-east-1", "sourceIPAddress": "198.51.100.77", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/jdoe", "accountId": "123456789012", "userName": "jdoe"}, "requestParameters": {"groupId": "sg-0abc123def456789a", "ipPermissions": {"items": [{"ipProtocol": "tcp", "fromPort": 22, "toPort": 22, "ipRanges": {"items": [{"cidrIp": "0.0.0.0/0", "description": "temp ssh access"}]}}]}}, "responseElements": {"securityGroupRuleSet": {"items": [{"securityGroupRuleId": "sgr-0temp1rule2345"}]}}}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:30:00Z", "eventSource": "monitoring.amazonaws.com", "eventName": "PutMetricData", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.20", "userAgent": "aws-sdk-java/2.20.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/monitoring-agent", "accountId": "123456789012", "userName": "monitoring-agent"}, "requestParameters": {"namespace": "Custom/AppMetrics"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:32:00Z", "eventSource": "logs.amazonaws.com", "eventName": "PutLogEvents", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.15", "userAgent": "aws-sdk-python/1.34.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/app-backend", "accountId": "123456789012", "userName": "app-backend"}, "requestParameters": {"logGroupName": "/aws/app/production", "logStreamName": "i-0abc123def456789/application.log"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:35:00Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeInstances", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:37:22Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "91.234.56.78", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/jdoe", "accountId": "123456789012", "userName": "jdoe"}, "responseElements": {"ConsoleLogin": "Success"}, "additionalEventData": {"MFAUsed": "No", "LoginTo": "https://console.aws.amazon.com/console/home", "MobileVersion": "No"}, "eventType": "AwsConsoleSignIn", "recipientAccountId": "123456789012"}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:38:00Z", "eventSource": "s3.amazonaws.com", "eventName": "ListBuckets", "awsRegion": "us-east-1", "sourceIPAddress": "91.234.56.78", "userAgent": "console.amazonaws.com", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/jdoe", "accountId": "123456789012", "userName": "jdoe"}, "requestParameters": null, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:40:00Z", "eventSource": "monitoring.amazonaws.com", "eventName": "PutMetricData", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.20", "userAgent": "aws-sdk-java/2.20.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/monitoring-agent", "accountId": "123456789012", "userName": "monitoring-agent"}, "requestParameters": {"namespace": "Custom/AppMetrics"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:42:00Z", "eventSource": "ec2.amazonaws.com", "eventName": "TerminateInstances", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"instancesSet": {"items": [{"instanceId": "i-0old789instance012"}]}}, "responseElements": {"instancesSet": {"items": [{"instanceId": "i-0old789instance012", "currentState": {"code": 32, "name": "shutting-down"}}]}}}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:44:00Z", "eventSource": "s3.amazonaws.com", "eventName": "GetObject", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.25", "userAgent": "aws-sdk-python/1.34.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/app-backend", "accountId": "123456789012", "userName": "app-backend"}, "requestParameters": {"bucketName": "corp-app-assets", "key": "templates/email-welcome.html"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:46:00Z", "eventSource": "iam.amazonaws.com", "eventName": "ListUsers", "awsRegion": "us-east-1", "sourceIPAddress": "91.234.56.78", "userAgent": "console.amazonaws.com", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/jdoe", "accountId": "123456789012", "userName": "jdoe"}, "requestParameters": null, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:48:00Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeInstances", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:50:00Z", "eventSource": "monitoring.amazonaws.com", "eventName": "PutMetricData", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.20", "userAgent": "aws-sdk-java/2.20.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/monitoring-agent", "accountId": "123456789012", "userName": "monitoring-agent"}, "requestParameters": {"namespace": "Custom/AppMetrics"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:52:00Z", "eventSource": "s3.amazonaws.com", "eventName": "GetObject", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.25", "userAgent": "aws-sdk-python/1.34.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/app-backend", "accountId": "123456789012", "userName": "app-backend"}, "requestParameters": {"bucketName": "corp-app-assets", "key": "static/js/bundle.min.js"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:54:00Z", "eventSource": "logs.amazonaws.com", "eventName": "PutLogEvents", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.15", "userAgent": "aws-sdk-python/1.34.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/app-backend", "accountId": "123456789012", "userName": "app-backend"}, "requestParameters": {"logGroupName": "/aws/app/production", "logStreamName": "i-0abc123def456789/application.log"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:56:00Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeSecurityGroups", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"securityGroupSet": {}, "filterSet": {}}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T08:58:00Z", "eventSource": "monitoring.amazonaws.com", "eventName": "PutMetricData", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.20", "userAgent": "aws-sdk-java/2.20.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/monitoring-agent", "accountId": "123456789012", "userName": "monitoring-agent"}, "requestParameters": {"namespace": "Custom/AppMetrics"}, "responseElements": null}
{"eventVersion": "1.09", "eventTime": "2026-01-15T09:00:00Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeInstances", "awsRegion": "us-east-1", "sourceIPAddress": "10.0.1.50", "userAgent": "aws-cli/2.15.0", "userIdentity": {"type": "IAMUser", "arn": "arn:aws:iam::123456789012:user/devops-jenkins", "accountId": "123456789012", "userName": "devops-jenkins"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "responseElements": null}