CloudHSM Event Dashboard index=main sourcetype="aws:cloudwatch:cloudhsm" NOT UNKNOWN_OPCODE |rex "^Time:\s(?<TimeStamp>\d{1,2}\/\d{1,2}\/\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2}\.\d{1,6})\,\s" | rex "Sequence No\s\s\:\s(?<Sequence_No>\d\w(..))\s" | rex "Reboot counter\s\s\:\s(?<Reboot_counter>\d\w(..))\s" | rex "Command Type\(hex\)\s\:\s(?<Command_Type>\w{1,20})\s" | rex "Opcode\s{3}\:\s(?<Op_Code>\w{8,50})\s"| rex "Session Handle\s{2}\:\s(?<Session_Handle>\w{1,16})\s"| rex "Response\s{2}\:\s(?<Response>\d{1,4}\:\w{1,6}\s\w{1,50}\:\s\S{1,50})\s" | rex "Log type\s{2}\:\s(?<Log_Type>\w{1,24})\s"| table TimeStamp, Log_Type, Command_Type, Op_Code, Response, Session_Handle, Sequence_No, Reboot_counter | mvexpand TimeStamp | fillnull value="Not Defined",Log_Type, Op_Code index=main sourcetype="aws:cloudwatch:cloudhsm"

Log Type All | stats count by Log_Type Log_Type Log_Type * * HSM Commands All | dedup Op_Code, Response | stats count by Op_Code Op_Code Op_Code * *

| search Log_Type= $Log_Type$ Op_Code=$Op_Code$ | dedup TimeStamp | stats count block none ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0x006d9c"] Total HSM Events 1 | search Opcode CN_LOGIN User Type CN_CRYPTO_USER Response RET_USER_LOGIN_FAILURE | rex "^Time:\s(?<TimeStamp>\d{1,2}\/\d{1,2}\/\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2}\.\d{1,6})\,\s" | rex "Sequence No\s\s\:\s(?<Sequence_No>\d\w(..))\s" | rex "Reboot counter\s\s\:\s(?<Reboot_counter>\d\w(..))\s" | rex "Command Type\(hex\)\s\:\s(?<Command_Type>\w{1,20})\s" | rex "Opcode\s{3}\:\s(?<Op_Code>\w{8,50})\s"| rex "Session Handle\s{2}\:\s(?<Session_Handle>\w{1,16})\s"| rex "Response\s{2}\:\s(?<Response>\d{1,4}\:\w{1,6}\s\w{1,50}\:\s\S{1,50})\s" | rex "Log type\s{2}\:\s(?<Log_Type>\w{1,24})\s"| table TimeStamp, Log_Type, Command_Type, Op_Code, Response, Session_Handle, Sequence_No, Reboot_counter| search Log_Type= $Log_Type$ Op_Code=$Op_Code$ |stats count block none ["0x53a051","0xdc4e41","0xdc4e41"] [0,1] Failed Crypto_User Login 1 | search Opcode CN_DESTROY_OBJECT | rex "^Time:\s(?<TimeStamp>\d{1,2}\/\d{1,2}\/\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2}\.\d{1,6})\,\s" | rex "Sequence No\s\s\:\s(?<Sequence_No>\d\w(..))\s" | rex "Reboot counter\s\s\:\s(?<Reboot_counter>\d\w(..))\s" | rex "Command Type\(hex\)\s\:\s(?<Command_Type>\w{1,20})\s" | rex "Opcode\s{3}\:\s(?<Op_Code>\w{8,50})\s"| rex "Session Handle\s{2}\:\s(?<Session_Handle>\w{1,16})\s"| rex "Response\s{2}\:\s(?<Response>\d{1,4}\:\w{1,6}\s\w{1,50}\:\s\S{1,50})\s" | rex "Log type\s{2}\:\s(?<Log_Type>\w{1,24})\s"| table TimeStamp, Log_Type, Command_Type, Op_Code, Response, Session_Handle, Sequence_No, Reboot_counter| search Log_Type= $Log_Type$ Op_Code=$Op_Code$ |stats count block none ["0x53a051","0xdc4e41","0xdc4e41"] [0,1] Total Delete Key Events 1 | search Log_Type= $Log_Type$ Op_Code=$Op_Code$| dedup Session_Handle, Log_Type | stats count by Log_Type pie 0 none | search Log_Type= $Log_Type$ Op_Code=$Op_Code$ | stats count by Op_Code pie none | search Log_Type= $Log_Type$ Op_Code=$Op_Code$ none