ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The userIdentity.arn element contains the Amazon Resource Name of the principal that made the API call, including the role name and account ID. Because an ARN is unique and remains constant regardless of the region from which a request originates, it is the most dependable value for tying together events generated by the same compromised role. Attributes such as eventName or awsRegion can vary from one request to another, and sourceIPAddress can change if the attacker routes traffic through different networks, making them less reliable for correlation.