CloudTrail log parsing/event selection with jq

filter.sh

# `aws s3 sync` the cloudtrail files you want into a dir, then...
cat * | jq '.Records[] | select(.eventSource == "kms.amazonaws.com")' | jq '.userIdentity.arn'

For an entire record like this, how would you be able to drop down into the user identity dictionary and look for usernames?
for example, show me every log with a event source "signin.amazonaws.com" and the username associated with that record,

{
"Records":[
{
"eventVersion":"1.08",
"userIdentity":{
"type":"IAMUser",
"principalId":"sensitive",
"arn":"arn:aws:iam::692263561378:user/JohnDoe",
"accountId":"blahblah",
"userName":"JohnDoe"
},
"eventTime":"2023-02-13T22:38:04Z",
"eventSource":"signin.amazonaws.com",
"eventName":"ConsoleLogin",
"awsRegion":"us-east-1",
"sourceIPAddress":"nottodayhackers",
"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
"requestParameters":null,
"responseElements":{
"ConsoleLogin":"Success"
},
"additionalEventData":{
"LoginTo":"https://us-east-1.console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&nc2=h_ct&region=us-east-1&skipRegion=true&src=header-signin&state=hashArgsFromTB_us-east-1_9823rh439rg9f8f34",
"MobileVersion":"No",
"MFAUsed":"No"
},
"eventID":"6a17cfa1-80ee-40e3-9bc4-b02309b13e10",
"readOnly":false,
"eventType":"AwsConsoleSignIn",
"managementEvent":true,
"recipientAccountId":"nottoday",
"eventCategory":"Management",
"tlsDetails":{
"tlsVersion":"TLSv1.2",
"cipherSuite":"ECDHE-RSA-AES128-GCM-SHA256",
"clientProvidedHostHeader":"signin.aws.amazon.com"
}
}
]
}