detection.wiki

AWS payments

eventNameDescriptionSampleRule
CashApplication_GetAccountBalanceCashApplication_GetAccountBalance recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.NN
CashApplication_SearchFinancialRecordsCashApplication_SearchFinancialRecords recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.NN
Preferences_GetPreferredCurrencyPreferences_GetPreferredCurrency recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.NN
Programs_ListPaymentProgramStatusPrograms_ListPaymentProgramStatus recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.NN

CashApplication_GetAccountBalance

#
Service
payments

Description

CashApplication_GetAccountBalance recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "1770c2d3-d5ae-4fd2-86fe-5b2f49dafb6d",
  "eventSource": "payments.amazonaws.com",
  "eventName": "CashApplication_GetAccountBalance",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "852102eb-0ff9-4904-b6a3-1e166365e9d1",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

References #

CashApplication_SearchFinancialRecords

#
Service
payments

Description

CashApplication_SearchFinancialRecords recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "021a06d6-2a06-48b1-9717-c6fcf4eca56f",
  "eventSource": "payments.amazonaws.com",
  "eventName": "CashApplication_SearchFinancialRecords",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "c990474d-54f4-4ed2-97d0-aa1029444259",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

References #

Preferences_GetPreferredCurrency

#
Service
payments

Description

Preferences_GetPreferredCurrency recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "3297d0af-7f7a-4e66-9bdf-09574a15a754",
  "eventSource": "payments.amazonaws.com",
  "eventName": "Preferences_GetPreferredCurrency",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "b4437d15-94bf-443e-a8c4-6482b0592dd1",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

References #

Programs_ListPaymentProgramStatus

#
Service
payments

Description

Programs_ListPaymentProgramStatus recorded by CloudTrail for AWS payments. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "59e793e5-03a0-4490-89a4-8723a0d5585b",
  "eventSource": "payments.amazonaws.com",
  "eventName": "Programs_ListPaymentProgramStatus",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "aed863b4-391a-42f1-b200-382fcfa1e7a1",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0",
  "errorCode": "AccessDenied",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

References #

any: AWS payments (catch-all)

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Service
payments

Description

Catch-all entry for AWS payments rules that match the service but not a specific eventName.