AWS Config sample event messages
Use these sample event messages to verify a successful integration with IBM QRadar.
Important: Due to formatting issues, paste the message format into a text editor and
then remove any carriage return or line feed characters.
AWS Config sample messages when you use the Amazon REST API protocol
Sample 1: The following sample event message shows that a resource is deleted.
"relatedEvents":[],"relationships":[],"supplementaryConfiguration":{},"tags":{},"configurationItemVersion":"1.3","configurationItemCaptureTime":"2023-01-14T04:04:35.970Z","configurationStateId":123456789000,"awsAccountId":"987654321000","configurationItemStatus":"ResourceDeleted","resourceType":"AWS::SSM::AssociationCompliance","resourceId":"AWS::SSM::ManagedInstanceInventory/i-0001bbbbbbbbbbbbb","awsRegion":"us-east-1","availabilityZone":"Regional","configurationStateMd5Hash":""} | QRadar field name | Highlighted values in the event payload |
|---|---|
| Event ID | ResourceDeleted |
| Event Category | AWSConfig |
| Timestamp | 2023-01-14T04:04:35.970Z |
Sample 2: The following sample event message shows the status of the configuration.
{"relatedEvents":[],"relationships":[],"configuration":{"ReceiveMessageWaitTimeSeconds":"0","SqsManagedSseEnabled":"false","CreatedTimestamp":"1585762081","DelaySeconds":"0","MessageRetentionPeriod":"345600","MaximumMessageSize":"262144","VisibilityTimeout":"30","LastModifiedTimestamp":"1585762081","QueueArn":"arn:aws:sqs:us-east-1:987654321000:demo_queue"},"supplementaryConfiguration":{"Tags":{}},"tags":{},"configurationItemVersion":"1.3","configurationItemCaptureTime":"2021-11-18T09:29:16.982Z","configurationStateId":123456789000,"awsAccountId":"987654321000","configurationItemStatus":"OK","resourceType":"AWS::SQS::Queue","resourceId":"https://sqs.us-east-1.example.com/987654321000/demo_queue","resourceName":"demo_queue","ARN":"arn:aws:sqs:us-east-1:987654321000:demo_queue","awsRegion":"us-east-1","availabilityZone":"Not Applicable","configurationStateMd5Hash":"","resourceCreationTime":"2020-04-01T17:28:01.000Z"}| QRadar field name | Highlighted values in the event payload |
|---|---|
| Event ID | OK |
| Event Category | AWSConfig |
| Timestamp | 2021-11-18T09:29:16 |