2 lines
344 B
Bash
2 lines
344 B
Bash
aws cloudtrail lookup-events --start-time $(date -d '48 hour ago' +%s) --lookup-attributes AttributeKey=Username,AttributeValue=LEDP636 | jq -cr '.Events[] | .CloudTrailEvent' | jq -cr '[.eventTime, .eventName, .userIdentity.userName, .sourceIPAddress, .additionalEventData.CredentialType, .serviceEventDetails.CredentialVerification] | @tsv'
|