{"session_id":"session-normal-001","label":"normal","attack_type":"normal","events":[{"observed":true,"action":"sts:AssumeRole","source":"src:sts.amazonaws.com","principal_type":"ptype:AssumedRole","principal_arn":"parn:arn:aws:iam::111122223333:role/dev_role","ip":"ip:corp","region":"region:us-east-1","ua":"ua:awscli","resource":"res:arn:aws:iam::111122223333:role/dev_role","time_bin":"time:t00"},{"observed":true,"action":"ecs:DescribeServices","source":"src:ecs.amazonaws.com","principal_type":"ptype:AssumedRole","principal_arn":"parn:arn:aws:iam::111122223333:role/dev_role","ip":"ip:corp","region":"region:us-east-1","ua":"ua:awscli","resource":"res:arn:aws:ecs:us-east-1:111122223333:service/demo-service","time_bin":"time:t01"},{"observed":true,"action":"ecs:UpdateService","source":"src:ecs.amazonaws.com","principal_type":"ptype:AssumedRole","principal_arn":"parn:arn:aws:iam::111122223333:role/dev_role","ip":"ip:corp","region":"region:us-east-1","ua":"ua:awscli","resource":"res:arn:aws:ecs:us-east-1:111122223333:service/demo-service","time_bin":"time:t02"},{"observed":true,"action":"s3:PutObject","source":"src:s3.amazonaws.com","principal_type":"ptype:AssumedRole","principal_arn":"parn:arn:aws:iam::111122223333:role/dev_role","ip":"ip:corp","region":"region:us-east-1","ua":"ua:awscli","resource":"res:arn:aws:s3:::identity-assurance-demo/output.json","time_bin":"time:t03"}]}
{"session_id":"session-blackout-attack-001","label":"attack","attack_type":"resource_hijack","events":[{"observed":true,"action":"sts:AssumeRole","source":"src:sts.amazonaws.com","principal_type":"ptype:AssumedRole","principal_arn":"parn:arn:aws:sts::111122223333:assumed-role/suspicious-role/session","ip":"ip:external","region":"region:us-west-2","ua":"ua:sdk","resource":"res:arn:aws:iam::111122223333:role/suspicious-role","time_bin":"time:t00"},{"observed":false},{"observed":false},{"observed":true,"action":"ec2:CreateTags","source":"src:ec2.amazonaws.com","principal_type":"ptype:AssumedRole","principal_arn":"parn:arn:aws:sts::111122223333:assumed-role/suspicious-role/session","ip":"ip:external","region":"region:us-west-2","ua":"ua:sdk","resource":"res:arn:aws:ec2:us-west-2:111122223333:instance/new","time_bin":"time:t03"},{"observed":true,"action":"cloudwatch:PutMetricData","source":"src:monitoring.amazonaws.com","principal_type":"ptype:AssumedRole","principal_arn":"parn:arn:aws:sts::111122223333:assumed-role/suspicious-role/session","ip":"ip:external","region":"region:us-west-2","ua":"ua:sdk","resource":"res:arn:aws:cloudwatch:us-west-2:111122223333:metric/demo","time_bin":"time:t04"}]}