Documentation

    Schema: Cloud Infrastructure

    Cloud provider context, API operations, and container runtime details. Includes AWS CloudTrail events, Azure/GCP API activity, container orchestration, and cloud account metadata.

    58 fields available

    ← Back to Schema Field Reference

    api.event_category

    CloudTrail event category (Management/Data/Insight)

    Providers: cloudtrail

    api.management_event

    CloudTrail managementEvent flag

    Providers: cloudtrail

    api.operation

    The API operation or action performed (AWS eventName)

    Providers: cloudtrail,azure_event_hub,gcp_pubsub

    api.read_only

    CloudTrail readOnly flag indicating read vs write operation

    Providers: cloudtrail

    api.request.attribute

    Attribute parameter from requestParameters.attribute

    Providers: cloudtrail

    api.request.attribute_name

    Name of the attribute from requestParameters.attributeName

    Providers: cloudtrail

    api.request.attribute_type

    Type of the attribute from requestParameters.attributeType

    Providers: cloudtrail

    api.request.bucket_name

    S3 bucket name (requestParameters.bucketName)

    Providers: cloudtrail

    api.request.cluster_name

    EKS/ECS cluster name (requestParameters.clusterName)

    Providers: cloudtrail

    api.request.container_command

    Container command from requestParameters.containerDefinitions.command

    Providers: cloudtrail

    api.request.credential_status

    Credential status from requestParameters.status

    Providers: cloudtrail

    api.request.db_instance_id

    RDS instance identifier (requestParameters.dBInstanceIdentifier)

    Providers: cloudtrail

    api.request.duration_seconds

    STS session duration in seconds (requestParameters.durationSeconds)

    Providers: cloudtrail

    api.request.encryption_algorithm

    KMS encryption algorithm (requestParameters.encryptionAlgorithm)

    Providers: cloudtrail

    api.request.function_name

    Lambda function name (requestParameters.functionName)

    Providers: cloudtrail

    api.request.instance_id

    EC2 instance ID (requestParameters.instanceId)

    Providers: cloudtrail

    api.request.is_egress_rule

    Whether a network ACL entry change targets the egress ruleset (requestParameters.egress). Genuinely boolean in the source event, confirmed by dynamicType over 30 days.

    Providers: cloudtrail

    api.request.key_id

    KMS key identifier (requestParameters.keyId)

    Providers: cloudtrail

    api.request.policy_arn

    IAM policy ARN (requestParameters.policyArn)

    Providers: cloudtrail

    api.request.policy_name

    IAM policy name from requestParameters.policyName

    Providers: cloudtrail

    api.request.resource_arn

    Resource ARN from requestParameters.arn

    Providers: cloudtrail

    api.request.role_arn

    Role ARN from requestParameters.roleArn

    Providers: cloudtrail

    api.request.role_name

    Target role name from requestParameters.roleName

    Providers: cloudtrail

    api.request.role_session_name

    Role session name from requestParameters.roleSessionName

    Providers: cloudtrail

    api.request.secret_id

    Secrets Manager secret ID (requestParameters.secretId)

    Providers: cloudtrail

    api.request.serial_number

    MFA serial number from requestParameters.serialNumber

    Providers: cloudtrail

    api.request.table_name

    DynamoDB table name (requestParameters.tableName)

    Providers: cloudtrail

    api.request.user_name

    Target user name from requestParameters.userName

    Providers: cloudtrail

    api.request.versioning_status

    S3 bucket versioning state in the request (requestParameters.VersioningConfiguration.Status). Suspended indicates versioning was turned off, which removes the recovery path after object deletion.

    Providers: cloudtrail

    api.response.access_key.uid

    Access key ID from responseElements.accessKey.accessKeyId

    Providers: cloudtrail

    api.response.access_key.user_name

    IAM user name the access key was created for from responseElements.accessKey.userName. Always populated on CreateAccessKey (unlike requestParameters.userName which is null on self-service calls).

    Providers: cloudtrail

    api.response.assumed_role_user.arn

    Assumed role ARN (responseElements.assumedRoleUser.arn)

    Providers: cloudtrail

    api.response.assumed_role_user.id

    Assumed role ID (responseElements.assumedRoleUser.assumedRoleId)

    Providers: cloudtrail

    api.response.console_login

    Console login result from responseElements.ConsoleLogin

    Providers: cloudtrail

    api.response.credentials.access_key_id

    STS temporary access key ID (responseElements.credentials.accessKeyId)

    Providers: cloudtrail

    api.response.credentials.expiration

    STS credentials expiration time (responseElements.credentials.expiration)

    Providers: cloudtrail

    api.response.mfa_device.serial_number

    MFA device serial number from responseElements.virtualMFADevice.serialNumber

    Providers: cloudtrail

    api.response.packed_policy_size

    Packed policy size from responseElements.packedPolicySize

    Providers: cloudtrail

    api.response.pending_password_change

    Indicates pending master user password change (responseElements.pendingModifiedValues.masterUserPassword)

    Providers: cloudtrail

    api.response.publicly_accessible

    Whether resource is publicly accessible (responseElements.publiclyAccessible)

    Providers: cloudtrail

    api.response.session.credentials.access_key_id

    Session temporary access key ID from responseElements.credentials.accessKeyId

    Providers: cloudtrail

    api.response.session.credentials.expiration

    Session credentials expiration time from responseElements.credentials.expiration

    Providers: cloudtrail

    api.response.session.credentials.session_token

    Session token from responseElements.credentials.sessionToken

    Providers: cloudtrail

    api.response.session.issuer

    Session issuer ARN from responseElements.assumedRoleUser.arn

    Providers: cloudtrail

    api.response.source_identity

    Source identity from responseElements.sourceIdentity

    Providers: cloudtrail

    api.response.user.arn

    IAM user ARN from responseElements.user.arn

    Providers: cloudtrail

    api.response.user.uid

    IAM user unique identifier from responseElements.user.userId

    Providers: cloudtrail

    api.scopes

    OAuth permission scopes presented on the API call, space-delimited in a single string as the vendor emits them. Frequently empty. No OCSF equivalent -- the OCSF api object carries only group, operation, request, response, service, token and version.

    Providers: Not specified

    api.service.name

    Name of the API service (AWS eventSource)

    Providers: cloudtrail,azure_event_hub,gcp_pubsub

    api.version

    Version of the API used for the request

    Providers: cloudtrail

    cloud.account.uid

    AWS account ID where the event occurred (recipientAccountId)

    Providers: cloudtrail,azure_event_hub,gcp_pubsub

    cloud.provider

    Cloud provider name (e.g. AWS).

    Providers: falco

    cloud.region


    Providers: cloudtrail

    container.image.name

    Full container image repository path.

    Providers: falco

    container.image.tag

    Container image tag or version.

    Providers: falco

    container.name

    Falco: Name of the container where the event occurred. Extracted from Kubernetes/Docker runtime context. Helps correlate security events to specific containerized workloads in orchestrated environments.

    Providers: falco

    container.orchestrator

    Kubernetes namespace where the container is running.

    Providers: falco

    container.pod_uuid

    Kubernetes pod name.

    Providers: falco

    Updated about 11 hours ago

    Did this page help you?