{
"AccountId": "741448936891",
"Arn": "arn:aws:guardduty:ap-south-1:741448936891:detector/66ca0946c7dfd299da283198338550ee/finding/34ca0cfb393882ceadb00e62be29dfc0",
"CreatedAt": "2024-12-30T23:46:09.137Z",
"Description": "AWS CloudTrail trail arn:aws:cloudtrail:ap-south-1:741448936891:trail/sample_test was disabled by anurag-aws-learn-new calling StopLogging under unusual circumstances. This can be attackers attempt to cover their tracks by eliminating any trace of activity performed while they accessed your account.",
"Id": "34ca0cfb393882ceadb00e62be29dfc0",
"Partition": "aws",
"Region": "ap-south-1",
"Resource": {
"AccessKeyDetails": {
"AccessKeyId": "ASIA2ZIOM5W5QMW3FGAP",
"PrincipalId": "741448936891",
"UserName": "anurag-aws-learn-new",
"UserType": "Root"
},
"ResourceType": "AccessKey"
},
"SchemaVersion": "2.0",
"Service": {
"Action": {
"ActionType": "AWS_API_CALL",
"AwsApiCallAction": {
"Api": "StopLogging",
"CallerType": "Remote IP",
"RemoteIpDetails": {
"City": {
"CityName": "Mumbai"
},
"Country": {
"CountryName": "India"
},
"GeoLocation": {
"Lat": 19.0748,
"Lon": 72.8856
},
"IpAddressV4": "134.238.16.127",
"Organization": {
"Asn": "394089",
"AsnOrg": "GCP-ENTERPRISE-USER-TRAFFIC",
"Isp": "Palo Alto Networks",
"Org": "Palo Alto Networks"
}
},
"ServiceName": "cloudtrail.amazonaws.com",
"AffectedResources": {
"AWS::CloudTrail::Trail": "arn:aws:cloudtrail:ap-south-1:741448936891:trail/sample_test"
}
}
},
"Archived": false,
"Count": 4,
"DetectorId": "66ca0946c7dfd299da283198338550ee",
"EventFirstSeen": "2024-12-30T23:36:16.000Z",
"EventLastSeen": "2025-01-01T03:35:11.000Z",
"ResourceRole": "TARGET",
"ServiceName": "guardduty",
"AdditionalInfo": {
"Value": "{}",
"Type": "default"
}
},
"Severity": 2,
"Title": "An AWS CloudTrail trail arn:aws:cloudtrail:ap-south-1:741448936891:trail/sample_test was disabled.",
"Type": "Stealth:IAMUser/CloudTrailLoggingDisabled",
"UpdatedAt": "2025-01-01T03:45:57.674Z"
}
This is a sample json log. I want to parse it. Can somebody guide me? I am new to this. can somebody suggest me any documentation or video from where I can get hold of json parsing from scratch.
@jstoner