fix sessionContext path

panther-labs · Dec 5, 2024 · 9f03e44 · 9f03e44
1 parent 49a5bdf
commit 9f03e44
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/data_models/aws_cloudtrail_data_model.py b/data_models/aws_cloudtrail_data_model.py
@@ -56,7 +56,12 @@ def get_actor_user(event):
         actor_user = deep_get(event, "userIdentity", "userName", default=f"Unknown{user_type}")
     elif user_type in ("AssumedRole", "Role", "FederatedUser"):
         actor_user = deep_get(
-            event, "sessionContext", "sessionIssuer", "userName", default=f"Unknown{user_type}"
+            event,
+            "userIdentity",
+            "sessionContext",
+            "sessionIssuer",
+            "userName",
+            default=f"Unknown{user_type}",
         )
     elif user_type == "IdentityCenterUser":
         actor_user = deep_get(