I have a block of json. Right now, I graph based on a single keyvalue named “eventName:ConsoleLogin”. I am looking to alert when “eventName: ConsoleLogin” happens on a mobile device. Below is the snippet of json.
{
“_index”: “logging-service-2020-12.log”,
“_type”: “_doc”,
“_id”: “xxxxxxxxxx”,
“_version”: 1,
“_score”: null,
“_source”: {
“eventSource”: “signin.amazonaws.com”,
“eventName”: “ConsoleLogin”,
“sourceIPAddress”: “x.x.x.x”,
“additionalEventData”: {
“LoginTo”: “https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true”,
“MobileVersion”: “No”,
“MFAUsed”: “Yes”
},
So, There is a field named MobileVersion in the block above. If that is yes, I would like to send an alert. Is that possible?
-Rick M