Cloudwatch Filters

http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

{ $.mfaAuthenticated = "false" }

{ $.userIdentity.type != "AssumedRole" }

{ ( $.eventSource != "iam.amazonaws.com" ) && ( $.eventSource != "cloudtrail.amazonaws.com" ) && ( $.eventSource != "elasticfilesystem.amazonaws.com" )}

{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName != "DescribeInstanceStatus" ) }

{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != "true" }

{ ( $.eventSource != "iam.amazonaws.com" ) && ( $.eventSource != "cloudtrail.amazonaws.com" ) && ( $.eventSource != "elasticfilesystem.amazonaws.com" ) && ( $.eventSource != "sts.amazonaws.com" ) && ( $.eventSource != "signin.amazonaws.com" ) && ( $.eventSource != "ec2.amazonaws.com" ) && ( $.eventSource != "logs.amazonaws.com" ) }

{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName != "DescribeInstanceStatus" ) && ( $.eventName != "DescribeVolumeStatus" ) && ( $.eventName != "DescribeAddresses" )}

{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName != "Describe*" ) && ( $.eventName != "Create*" ) && ( $.eventName != "Delete*" ) }

{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName = "StopInstances" ) }

{ ( $.eventName != "DescribeVolumeStatus" )  && ( $.eventName != "DescribeAddresses" ) && ( $.eventName != "DescribeAddresses" )}

someone messed with my ASG!!

{ $.eventName = "UpdateAutoScalingGroup" }

someone's messing with my EKS

{ ( $.objectRef.namespace = "kube-system" ) && ( $.Kind != "Event" ) && ( $.verb != "watch" ) }