{"session_id":"session-normal-001","label":"normal","attack_type":"normal","event_index":0,"eventTime":"2026-04-22T09:00:00Z","eventName":"AssumeRole","eventSource":"sts.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:iam::111122223333:role/dev_role"},"sourceIPAddress":"10.0.14.22","awsRegion":"us-east-1","userAgent":"aws-cli/2.15.0","resource":"arn:aws:iam::111122223333:role/dev_role","time_bin":"t00"}
{"session_id":"session-normal-001","label":"normal","attack_type":"normal","event_index":1,"eventTime":"2026-04-22T09:00:10Z","eventName":"DescribeServices","eventSource":"ecs.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:iam::111122223333:role/dev_role"},"sourceIPAddress":"10.0.14.22","awsRegion":"us-east-1","userAgent":"aws-cli/2.15.0","resource":"arn:aws:ecs:us-east-1:111122223333:service/demo-service","time_bin":"t01"}
{"session_id":"session-normal-001","label":"normal","attack_type":"normal","event_index":2,"eventTime":"2026-04-22T09:00:20Z","eventName":"UpdateService","eventSource":"ecs.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:iam::111122223333:role/dev_role"},"sourceIPAddress":"10.0.14.22","awsRegion":"us-east-1","userAgent":"aws-cli/2.15.0","resource":"arn:aws:ecs:us-east-1:111122223333:service/demo-service","time_bin":"t02"}
{"session_id":"session-normal-001","label":"normal","attack_type":"normal","event_index":3,"eventTime":"2026-04-22T09:00:35Z","eventName":"PutObject","eventSource":"s3.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:iam::111122223333:role/dev_role"},"sourceIPAddress":"10.0.14.22","awsRegion":"us-east-1","userAgent":"aws-cli/2.15.0","resource":"arn:aws:s3:::identity-assurance-demo/output.json","time_bin":"t03"}
{"session_id":"session-suspicious-001","label":"attack","attack_type":"resource_hijack","event_index":0,"eventTime":"2026-04-22T11:17:00Z","eventName":"AssumeRole","eventSource":"sts.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::111122223333:assumed-role/suspicious-role/session"},"sourceIPAddress":"198.51.100.25","awsRegion":"us-west-2","userAgent":"Boto3/1.34.0 Python/3.10","resource":"arn:aws:iam::111122223333:role/suspicious-role","time_bin":"t00"}
{"session_id":"session-suspicious-001","label":"attack","attack_type":"resource_hijack","event_index":1,"eventTime":"2026-04-22T11:17:15Z","eventName":"DescribeInstances","eventSource":"ec2.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::111122223333:assumed-role/suspicious-role/session"},"sourceIPAddress":"198.51.100.25","awsRegion":"us-west-2","userAgent":"Boto3/1.34.0 Python/3.10","resource":"arn:aws:ec2:us-west-2:111122223333:instance/*","time_bin":"t01"}
{"session_id":"session-suspicious-001","label":"attack","attack_type":"resource_hijack","event_index":2,"eventTime":"2026-04-22T11:17:28Z","eventName":"RunInstances","eventSource":"ec2.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::111122223333:assumed-role/suspicious-role/session"},"sourceIPAddress":"198.51.100.25","awsRegion":"us-west-2","userAgent":"Boto3/1.34.0 Python/3.10","resource":"arn:aws:ec2:us-west-2:111122223333:instance/new","time_bin":"t02"}
{"session_id":"session-suspicious-001","label":"attack","attack_type":"resource_hijack","event_index":3,"eventTime":"2026-04-22T11:17:44Z","eventName":"CreateTags","eventSource":"ec2.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::111122223333:assumed-role/suspicious-role/session"},"sourceIPAddress":"198.51.100.25","awsRegion":"us-west-2","userAgent":"Boto3/1.34.0 Python/3.10","resource":"arn:aws:ec2:us-west-2:111122223333:instance/new","time_bin":"t03"}
{"session_id":"session-suspicious-001","label":"attack","attack_type":"resource_hijack","event_index":4,"eventTime":"2026-04-22T11:18:00Z","eventName":"PutMetricData","eventSource":"monitoring.amazonaws.com","userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::111122223333:assumed-role/suspicious-role/session"},"sourceIPAddress":"198.51.100.25","awsRegion":"us-west-2","userAgent":"Boto3/1.34.0 Python/3.10","resource":"arn:aws:cloudwatch:us-west-2:111122223333:metric/demo","time_bin":"t04"}