AWS EKS audit logs, which ingested from Sentinel’s connector, contain detailed information about API server requests, authentication decisions, and cluster activities from Amazon Elastic Kubernetes Service. These logs provide comprehensive security monitoring and compliance tracking for Kubernetes clusters.
Schema
Name
Description
Type
_BilledSize
Double
_IsBillable
String
AuthDecision
The authorization decision made by the Kubernetes RBAC system (e.g., allow, forbid).
String
AwsAccountId
The AWS account ID where the EKS cluster is located.
String
ClusterName
The name of the EKS cluster that generated the audit event.
String
ObjectRef
Reference to the Kubernetes object that was accessed (namespace/resource/name).
String
RawEvent
The complete raw EKS audit event data containing additional context and metadata.
Object
Region
The AWS region where the EKS cluster is located.
String
ResponseCode
The HTTP response status code of the API request.
Int32
SourceIPs
Array of source IP addresses from where the request originated.
Object
SourceSystem
String
Stage
The stage of request processing when the audit event was generated (e.g., RequestReceived, ResponseComplete).
String
TenantId
Unique identifier of the tenant into which the data connector ingests data.
String
TimeGenerated
The timestamp (UTC) when the EKS audit event was generated.
DateTime
Type
The name of the table
String
User
The user or service account that performed the action.
String
UserAgent
The user agent string of the client that made the request.
String
Verb
The Kubernetes API verb (action) performed (e.g., get, create, update, delete).