Add note on logs generated by console logins (#382)

* Add note on logs generated by console logins * Autogenerate docs
DataDog · Jul 3, 2023 · a7f75e9 · a7f75e9
1 parent d27b459
commit a7f75e9
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/docs/attack-techniques/AWS/aws.initial-access.console-login-without-mfa.md b/docs/attack-techniques/AWS/aws.initial-access.console-login-without-mfa.md
@@ -76,4 +76,6 @@ Sample CloudTrail event (redacted for clarity):
 }
 ```
 
+Note that for failed console authentication events, the field <code>userIdentity.arn</code> is not set (see https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html#cloudtrail-aws-console-sign-in-events-iam-user-failure).
+
 
diff --git a/v2/internal/attacktechniques/aws/initial-access/console-login-without-mfa/main.go b/v2/internal/attacktechniques/aws/initial-access/console-login-without-mfa/main.go
@@ -75,6 +75,8 @@ Sample CloudTrail event (redacted for clarity):
 	}
 }
 ` + codeBlock + `
+
+Note that for failed console authentication events, the field <code>userIdentity.arn</code> is not set (see https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html#cloudtrail-aws-console-sign-in-events-iam-user-failure).
 `,
 		Platform:                   stratus.AWS,
 		IsIdempotent:               true,