security_review_useraction.py

reload(cloudtrail_helpers)
endtime = datetime.datetime.now()  # Create start and end time for CloudTrail lookup
interval = datetime.timedelta(hours=48) 
starttime = endtime - interval
reload(cloudtrail_helpers)
eventdf = cloudtrail_helpers.get_events_all_df(starttime, endtime)

eventdf['Resources'] = eventdf['Resources'].astype(str)

oeventdf = eventdf.copy()

eventdf = eventdf.drop_duplicates(["EventSource","EventName"])


cdf_eventnames = eventdf.groupby( ["EventSource"] )['EventName'].agg(','.join).reset_index(name='EventNames')
cdf_eventnames = cdf_eventnames [["EventSource",'EventNames' ]]

eventdf.userAgent = eventdf.userAgent.astype(str)
eventdf = eventdf.groupby( ["EventSource", "EventName","Username", 'sourceIPAddress'] )['userAgent'].agg(','.join).reset_index(name='UserAgents')
eventdf = eventdf.groupby( ["EventSource",'UserAgents',"Username", 'sourceIPAddress'] )['EventName'].agg(','.join).reset_index(name='Eventnames')
cdf_eventnames = eventdf [["EventSource", "Eventnames","Username", 'UserAgents' ,'sourceIPAddress' ]]
display (md("### Events with non console login User Agents"))
display(HTML(cdf_eventnames[~cdf_eventnames.UserAgents.str.contains("console")].drop_duplicates().to_html(index=False, justify="left" , border = 1)))