AWS CloudTrail

eventName	Description	Sample	Rule
any	Catch-all entry for AWS CloudTrail rules that match the service but not a specific eventName.	N	N
CreateTrail	Creates a CloudTrail trail that delivers log files recording API activity in the account to the specified Amazon S3 bucket.	Y	Y
DeleteTrail	Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.	Y	Y
DescribeTrails	Returns metadata about one or more CloudTrail trails in the current region, including their ARNs, S3 destinations, and configuration settings.	Y	Y
LookupEvents	Searches CloudTrail management event records in the current region for events matching specified attribute filters such as event name, resource type, or username.	Y	Y
PutEventSelectors	Configures event selectors for a trail to specify which management and data events CloudTrail logs.	Y	Y
StopLogging	Suspends CloudTrail logging for a trail, halting the delivery of new log files while preserving the trail configuration.	Y	Y
UpdateTrail	Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.	Y	Y
AddTags	Adds one or more tags to a trail, event data store, dashboard, or channel, up to a limit of 50.	Y	N
CancelQuery	Cancels a query if the query is not in a terminated state, such as CANCELLED, FAILED, TIMED_OUT, or FINISHED.	Y	N
CreateChannel	Creates a channel for CloudTrail to ingest events from a partner or external source.	N	N
CreateDashboard	Creates a custom dashboard or the Highlights dashboard.	Y	N
CreateEventDataStore	Creates a new event data store.	Y	N
DeleteChannel	Deletes a channel.	N	N
DeleteDashboard	Deletes the specified dashboard.	Y	N
DeleteEventDataStore	Disables the event data store specified by EventDataStore, which accepts an event data store ARN.	N	N
DeleteResourcePolicy	Deletes the resource-based policy attached to the CloudTrail event data store, dashboard, or channel.	N	N
DeregisterOrganizationDelegatedAdmin	Removes CloudTrail delegated administrator permissions from a member account in an organization.	Y	N
DescribeQuery	Returns metadata about a query, including query run time in milliseconds, number of events scanned and matched, and query status.	N	N
DisableFederation	Disables Lake query federation on the specified event data store.	N	N
EnableFederation	Enables Lake query federation on the specified event data store.	N	N
GenerateQuery	Generates a query from a natural language prompt.	N	N
GetChannel	Returns information about a specific channel.	N	N
GetDashboard	Returns the specified dashboard.	N	N
GetEventConfiguration	Retrieves the current event configuration settings for the specified event data store or trail.	Y	N
GetEventDataStore	Returns information about an event data store specified as either an ARN or the ID portion of the ARN.	N	N
GetEventSelectors	Describes the settings for the event selectors that you configured for your trail.	Y	N
GetImport	Returns information about a specific import.	Y	N
GetInsightSelectors	Describes the settings for the Insights event selectors that you configured for your trail or event data store.	Y	N
GetQueryResults	Gets event data results of a query.	Y	N
GetResourcePolicy	Retrieves the JSON text of the resource-based policy document attached to the CloudTrail event data store, dashboard, or channel.	N	N
GetTrail	Returns settings information for a specified trail.	Y	N
GetTrailStatus	Returns a JSON-formatted list of information about the specified trail.	Y	N
ListChannels	Lists the channels in the current account, and their source names.	Y	N
ListDashboards	Returns information about all dashboards in the account, in the current Region.	Y	N
ListEventDataStores	Returns information about all event data stores in the account, in the current Region.	Y	N
ListImportFailures	Returns a list of failures for the specified import.	Y	N
ListImports	Returns information on all imports, or a select set of imports by ImportStatus or Destination.	Y	N
ListInsightsData	Returns Insights events generated on a trail that logs data events.	N	N
ListInsightsMetricData	Returns Insights metrics data for trails that have enabled Insights.	Y	N
ListPublicKeys	Returns all public keys whose private keys were used to sign the digest files within the specified time range.	Y	N
ListQueries	Returns a list of queries and query statuses for the past seven days.	N	N
ListTags	Lists the tags for the specified trails, event data stores, dashboards, or channels in the current Region.	Y	N
ListTrails	Lists trails that are in the current account.	Y	N
PutEventConfiguration	Updates the event configuration settings for the specified event data store or trail.	Y	N
PutInsightSelectors	Lets you enable Insights event logging on specific event categories by specifying the Insights selectors that you want to enable on an existing trail or event data store.	Y	N
PutResourcePolicy	Attaches a resource-based permission policy to a CloudTrail event data store, dashboard, or channel.	N	N
RegisterOrganizationDelegatedAdmin	Registers an organization’s member account as the CloudTrail delegated administrator.	N	N
RemoveTags	Removes the specified tags from a trail, event data store, dashboard, or channel.	Y	N
RestoreEventDataStore	Restores a deleted event data store specified by EventDataStore, which accepts an event data store ARN.	N	N
SearchSampleQueries	Searches sample queries and returns a list of sample queries that are sorted by relevance.	Y	N
StartDashboardRefresh	Starts a refresh of the specified dashboard.	Y	N
StartEventDataStoreIngestion	Starts the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN.	N	N
StartImport	Starts an import of logged trail events from a source S3 bucket to a destination event data store.	N	N
StartLogging	Starts the recording of Amazon Web Services API calls and log file delivery for a trail.	Y	Y
StartQuery	Starts a CloudTrail Lake query.	N	N
StopEventDataStoreIngestion	Stops the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN.	N	N
StopImport	Stops a specified import.	Y	N
UpdateChannel	Updates a channel specified by a required channel ARN or UUID.	N	N
UpdateDashboard	Updates the specified dashboard.	Y	N
UpdateEventDataStore	Updates an event data store.	N	N
ListServiceLinkedChannels	ListServiceLinkedChannels recorded by CloudTrail for AWS CloudTrail. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: AWS CloudTrail (catch-all)

Service: cloudtrail

Description

Catch-all entry for AWS CloudTrail rules that match the service but not a specific eventName.

CreateTrail

Service: cloudtrail

Description

Creates a CloudTrail trail that delivers log files recording API activity in the account to the specified Amazon S3 bucket.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "3a1acb39-c13b-4e73-a0e3-dcd8ce5c1a3a",
  "eventName": "CreateTrail",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:00:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "4edf7a39-124f-4a63-aa7c-fd7c2e392909",
  "requestParameters": {
    "includeGlobalServiceEvents": true,
    "name": "stratus-red-team-ctlr-trail-zqfsvooxqj",
    "s3BucketName": "stratus-red-team-ctlr-bucket-zqfsvooxqj",
    "tagsList": [
      {
        "key": "StratusRedTeam",
        "value": "true"
      }
    ]
  },
  "responseElements": {
    "includeGlobalServiceEvents": true,
    "isMultiRegionTrail": false,
    "isOrganizationTrail": false,
    "logFileValidationEnabled": false,
    "name": "stratus-red-team-ctlr-trail-zqfsvooxqj",
    "s3BucketName": "stratus-red-team-ctlr-bucket-zqfsvooxqj",
    "trailARN": "arn:aws:cloudtrail:us-east-1:123837392027:trail/stratus-red-team-ctlr-trail-zqfsvooxqj"
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_4990da05-9399-449e-b49f-82996a764ec9 HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS CloudTrail Log Created source low: Detects creation of a new AWS CloudTrail trail via CreateTrail API. While legitimate during onboarding or auditing improvements, adversaries can create trails that write to attacker-controlled destinations, limit regions, or otherwise subvert monitoring objectives. New trails should be validated for destination ownership, encryption, multi-region coverage, and organizational scope.T1530, T1562, T1562.008

Panther #

A CloudTrail Was Created or Updated source informational: A CloudTrail Trail was created, updated, or enabled.T1538↳ also matches UpdateTrail, StartLogging

References #

Sample log: invictus-ir/aws_dataset

DeleteTrail

Service: cloudtrail

Description

Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "fcec2e46-3cc3-4ac2-8144-3674f06990e4",
  "eventName": "DeleteTrail",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:08:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "86df4a18-3ab7-4ed3-b542-2f932957aa6e",
  "requestParameters": {
    "name": "stratus-red-team-ctes-trail-qyxyekjbtk"
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (sigma rule field)	eq	`accessdenied`	1 rule	sigma
`aws::errorCode` (splunk rule field)	eq	`success`	1 rule	splunk
`userAgent` (splunk rule field)	ne	`console.amazonaws.com`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS CloudTrail Important Change source medium: Detects disabling, deleting and updating of a TrailT1685, T1685.002↳ also matches StopLogging, UpdateTrail
Attempt To Delete A CloudTrail Log source medium: A attacker may have attempted to delete a CloudTrail log but it was denied due to a lack of permissions. Sample command line: aws cloudtrail delete-trail --name TrailNameT1562, T1562.008
CloudTrail Log Deleted source medium: A user attempted to delete a CloudTrail log but it was denied due to a lack of permissions. Sample command line: aws cloudtrail delete-trail --name TrailNameT1562, T1562.008

Elastic #

AWS CloudTrail Log Deleted source medium: Detects deletion of an AWS CloudTrail trail via DeleteTrail API. Removing trails is a high-risk action that destroys an audit control plane and is frequently paired with other destructive or stealthy operations. Validate immediately and restore compliant logging.T1562, T1562.001, T1562.008

Splunk #

ASL AWS Defense Evasion Delete Cloudtrail source: The following analytic detects AWS DeleteTrail events within CloudTrail logs. It leverages Amazon Security Lake logs parsed in the Open Cybersecurity Schema Framework (OCSF) format to identify when a CloudTrail is deleted. This activity…T1685, T1685.002
AWS Defense Evasion Delete Cloudtrail source: The following analytic detects the deletion of AWS CloudTrail logs by identifying DeleteTrail events within CloudTrail logs. This detection leverages CloudTrail data to monitor for successful DeleteTrail actions, excluding those…T1685, T1685.002

Kusto #

AWSCloudTrail - Changes made to AWS CloudTrail logs source low: Identifies manipulation of AWS CloudTrail, CloudWatch/EventBridge, or VPC Flow Logs that can indicate defense evasion. This alert identifies any manipulation of AWS CloudTrail, Cloudwatch/EventBridge or VPC Flow logs. More Information: AWS CloudTrail API: https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_Operations.html AWS Cloudwatch/Eventbridge API: https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Operations.html AWS DelteteFlowLogs API : https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html 'T1070↳ also matches StopLogging, UpdateTrail
AWSCloudTrail - Config Service Resource Deletion Attempts source low: Identifies AWS API calls that attempt to reduce logging or visibility in an account by stopping logging, deleting trails, deleting flow logs, or deleting event buses. This behavior can indicate defense evasion or the deliberate suppression of telemetry used to monitor security posture.T1562, T1562.008↳ also matches StopLogging, UpdateTrail
AWSCloudTrail - Tampering to AWS CloudTrail logs source high: Detects successful attempts to disable, delete, or weaken AWS logging telemetry, including CloudTrail, CloudWatch/EventBridge, and VPC flow logs. This behavior can indicate defense evasion and deliberate reduction of incident visibility by an attacker.T1562, T1562.008↳ also matches StopLogging, UpdateTrail

YARA-L #

AWS CloudTrail Logging Tampered source high: Detects when CloudTrail logging is updated, stopped or deleted.T1562↳ also matches PutEventSelectors, StopLogging, UpdateTrail

Panther #

CloudTrail Stopped source medium: A CloudTrail Trail was modified.T1562↳ also matches StopLogging
Account Security Configuration Changed source medium: An account wide security configuration was changed.T1562↳ also matches StopLogging

References #

Sample log: invictus-ir/aws_dataset

DescribeTrails

Service: cloudtrail

Description

Returns metadata about one or more CloudTrail trails in the current region, including their ARNs, S3 destinations, and configuration settings.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "fab5c860-203b-4776-9791-90c51611d388",
  "eventName": "DescribeTrails",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:29:20Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "36efaf2a-d7d2-40a6-aa87-e89667b077fe",
  "requestParameters": {
    "includeShadowTrails": true,
    "trailNameList": []
  },
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "10.8.8.10",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSCXRLH2ACF",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T12:27:45Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userIdentity.arn` (elastic rule field)	is_not_null		1 rule	elastic
`source.as.number` (elastic rule field)	in	`9009`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580↳ also matches LookupEvents

References #

Sample log: invictus-ir/aws_dataset

LookupEvents

Service: cloudtrail

Description

Searches CloudTrail management event records in the current region for events matching specified attribute filters such as event name, resource type, or username.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "1779cc20-8612-441f-a2be-e1f3163d87c7",
  "eventName": "LookupEvents",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:29:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "2364507e-8bb9-4272-a9c2-b58521e6c2f8",
  "requestParameters": {
    "eventCategory": "insight",
    "maxResults": 25
  },
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "10.8.8.10",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSCXRLH2ACF",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T12:27:45Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userIdentity.arn` (elastic rule field)	is_not_null		1 rule	elastic
`source.as.number` (elastic rule field)	in	`9009`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580↳ also matches DescribeTrails

References #

Sample log: invictus-ir/aws_dataset

PutEventSelectors

Service: cloudtrail

Description

Configures event selectors for a trail to specify which management and data events CloudTrail logs.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "076e96d5-2983-473f-920a-2fc2d7e02777",
  "eventName": "PutEventSelectors",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:00:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "966e1d28-e542-4f65-aaae-170b63074607",
  "requestParameters": {
    "eventSelectors": [
      {
        "dataResources": [
          {
            "type": "AWS::S3::Object",
            "values": []
          },
          {
            "type": "AWS::Lambda::Function",
            "values": []
          }
        ],
        "excludeManagementEventSources": [],
        "includeManagementEvents": false,
        "readWriteType": "ReadOnly"
      }
    ],
    "trailName": "stratus-red-team-ctes-trail-qyxyekjbtk"
  },
  "responseElements": {
    "eventSelectors": [
      {
        "dataResources": [
          {
            "type": "AWS::S3::Object",
            "values": []
          },
          {
            "type": "AWS::Lambda::Function",
            "values": []
          }
        ],
        "excludeManagementEventSources": [],
        "includeManagementEvents": false,
        "readWriteType": "ReadOnly"
      }
    ],
    "trailARN": "arn:aws:cloudtrail:us-east-1:123837392027:trail/stratus-red-team-ctes-trail-qyxyekjbtk"
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_1d949e3e-4092-4c96-a6ef-96a967510a46",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS CloudTrail Management Events Disabled via PutEventSelectors source medium: Detects CloudTrail PutEventSelectors calls where the legacy event selectors explicitly set includeManagementEvents to false, disabling capture of all management API calls for that trail. Unlike StopLogging or DeleteTrail — which leave an obvious trace of the trail being stopped or removed entirely — this technique leaves the trail appearing active and healthy in the console while silently blinding defenders to subsequent IAM changes, credential operations, and resource abuse. This technique is documented in Stratus Red Team as aws.defense-evasion.cloudtrail-event-selectors and is a known pre-exfiltration step.T1562, T1562.008

YARA-L #

AWS CloudTrail Logging Tampered source high: Detects when CloudTrail logging is updated, stopped or deleted.T1562↳ also matches DeleteTrail, StopLogging, UpdateTrail

Panther #

CloudTrail Event Selectors Disabled source medium: A CloudTrail Trail was modified to exclude management events for 1 or more resource types.T1562

References #

Sample log: invictus-ir/aws_dataset

StopLogging

Service: cloudtrail

Description

Suspends CloudTrail logging for a trail, halting the delivery of new log files while preserving the trail configuration.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "TrailNotFoundException",
  "errorMessage": "Unknown trail: arn:aws:cloudtrail:us-east-1:123837392027:trail/stratus-red-team-ct-stop-trail-qzbgnfqisx for the user: 123837392027",
  "eventCategory": "Management",
  "eventID": "f6e10706-705c-47f2-94d4-112a9527ab8b",
  "eventName": "StopLogging",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:01:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "028c8f71-8342-435b-a295-ada7ea8b9f0f",
  "requestParameters": {
    "name": "stratus-red-team-ct-stop-trail-qzbgnfqisx"
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_e27c7b82-502b-4432-a99a-be984762c413",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`userAgent` (splunk rule field)	ne	`console.amazonaws.com`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Attempt To Stop CloudTrail Logging source medium: A user attempted to disable CloudTrail logging but it was denied due to a lack of permissions. Sample command line: aws cloudtrail stop-logging --name TrailNameT1562, T1562.008
CloudTrail Logging Stopped source high: A user successfully disabled CloudTrail logging. Sample command line: aws cloudtrail stop-logging --name TrailNameT1562, T1562.008
AWS CloudTrail Important Change source medium: Detects disabling, deleting and updating of a TrailT1685, T1685.002↳ also matches DeleteTrail, UpdateTrail

Elastic #

AWS CloudTrail Log Suspended source high: Detects Cloudtrail logging suspension via StopLogging API. Stopping CloudTrail eliminates forward audit visibility and is a classic defense evasion step before sensitive changes or data theft. Investigate immediately and determine what occurred during the logging gap.T1562, T1562.001, T1562.008

Splunk #

ASL AWS Defense Evasion Stop Logging Cloudtrail source: The following analytic detects StopLogging events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. By halting the logging of their malicious activities, attackers aim to operate undetected within…T1685, T1685.002
AWS Defense Evasion Stop Logging Cloudtrail source: The following analytic detects StopLogging events in AWS CloudTrail logs. It leverages CloudTrail event data to identify when logging is intentionally stopped, excluding console-based actions and focusing on successful attempts. This…T1685, T1685.002

Kusto #

AWSCloudTrail - Changes made to AWS CloudTrail logs source low: Identifies manipulation of AWS CloudTrail, CloudWatch/EventBridge, or VPC Flow Logs that can indicate defense evasion. This alert identifies any manipulation of AWS CloudTrail, Cloudwatch/EventBridge or VPC Flow logs. More Information: AWS CloudTrail API: https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_Operations.html AWS Cloudwatch/Eventbridge API: https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Operations.html AWS DelteteFlowLogs API : https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html 'T1070↳ also matches DeleteTrail, UpdateTrail
AWSCloudTrail - Config Service Resource Deletion Attempts source low: Identifies AWS API calls that attempt to reduce logging or visibility in an account by stopping logging, deleting trails, deleting flow logs, or deleting event buses. This behavior can indicate defense evasion or the deliberate suppression of telemetry used to monitor security posture.T1562, T1562.008↳ also matches DeleteTrail, UpdateTrail
AWSCloudTrail - Tampering to AWS CloudTrail logs source high: Detects successful attempts to disable, delete, or weaken AWS logging telemetry, including CloudTrail, CloudWatch/EventBridge, and VPC flow logs. This behavior can indicate defense evasion and deliberate reduction of incident visibility by an attacker.T1562, T1562.008↳ also matches DeleteTrail, UpdateTrail

YARA-L #

AWS CloudTrail Logging Tampered source high: Detects when CloudTrail logging is updated, stopped or deleted.T1562↳ also matches DeleteTrail, PutEventSelectors, UpdateTrail

Panther #

CloudTrail Stopped source medium: A CloudTrail Trail was modified.T1562↳ also matches DeleteTrail
Account Security Configuration Changed source medium: An account wide security configuration was changed.T1562↳ also matches DeleteTrail

References #

Sample log: invictus-ir/aws_dataset

UpdateTrail

Service: cloudtrail

Description

Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "700d3db1-400f-4695-bef9-dc7076c29ec3",
  "eventName": "UpdateTrail",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2021-07-07T13:17:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "797507667711",
  "requestID": "56020724-5bf5-4001-86bc-4b19a3f32a86",
  "requestParameters": {
    "cloudWatchLogsLogGroupArn": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "cloudWatchLogsRoleArn": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "name": "arn:aws:cloudtrail:us-east-2:797507667711:trail/management-events"
  },
  "responseElements": {
    "cloudWatchLogsLogGroupArn": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "cloudWatchLogsRoleArn": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "includeGlobalServiceEvents": true,
    "isMultiRegionTrail": true,
    "isOrganizationTrail": false,
    "logFileValidationEnabled": false,
    "name": "management-events",
    "s3BucketName": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "trailARN": "arn:aws:cloudtrail:us-east-2:797507667711:trail/management-events"
  },
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "213.205.197.162",
  "userAgent": "console.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIA3TLZJI37XXVQGUXV",
    "accountId": "797507667711",
    "arn": "arn:aws:iam::797507667711:user/bruce",
    "principalId": "AIDA3TLZJI372XH6M2Q25",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T11:45:11Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bruce"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`userAgent` (splunk rule field)	ne	`console.amazonaws.com`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Attempt To Modify CloudTrail Log Settings source medium: An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions. An attacker can use the update-trail command to disable multi-region logging, so their attacks do not get logged to the other regions. Ex: aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs. The attacker may also redirect the logs to a S3 bucket they control.T1562, T1562.008
CloudTrail Log Settings Modified source high: An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions. An attacker can use the update-trail command to disable multi-region logging, so their attacks do not get logged to the other regions. Ex: aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs. The attacker may also redirect the logs to a S3 bucket they control.T1562, T1562.008
AWS CloudTrail Important Change source medium: Detects disabling, deleting and updating of a TrailT1685, T1685.002↳ also matches DeleteTrail, StopLogging

Elastic #

AWS CloudTrail Log Updated source high: Detects updates to an existing CloudTrail trail via UpdateTrail API which may reduce visibility, change destinations, or weaken integrity (e.g., removing global events, moving the S3 destination, or disabling validation). Adversaries can modify trails to evade detection while maintaining a semblance of logging. Validate any configuration change against approved baselines.T1530, T1562, T1562.008, T1565, T1565.001

Splunk #

ASL AWS Defense Evasion Update Cloudtrail source: The following analytic detects UpdateTrail events within AWS CloudTrail logs, aiming to identify attempts by attackers to evade detection by altering logging configurations. By updating CloudTrail settings with incorrect parameters, such…T1685, T1685.002
AWS Defense Evasion Update Cloudtrail source: The following analytic detects UpdateTrail events in AWS CloudTrail logs. It identifies attempts to modify CloudTrail settings, potentially to evade logging. The detection leverages CloudTrail logs, focusing on UpdateTrail events where…T1685, T1685.002

Kusto #

AWSCloudTrail - Changes made to AWS CloudTrail logs source low: Identifies manipulation of AWS CloudTrail, CloudWatch/EventBridge, or VPC Flow Logs that can indicate defense evasion. This alert identifies any manipulation of AWS CloudTrail, Cloudwatch/EventBridge or VPC Flow logs. More Information: AWS CloudTrail API: https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_Operations.html AWS Cloudwatch/Eventbridge API: https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Operations.html AWS DelteteFlowLogs API : https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html 'T1070↳ also matches DeleteTrail, StopLogging
AWSCloudTrail - Config Service Resource Deletion Attempts source low: Identifies AWS API calls that attempt to reduce logging or visibility in an account by stopping logging, deleting trails, deleting flow logs, or deleting event buses. This behavior can indicate defense evasion or the deliberate suppression of telemetry used to monitor security posture.T1562, T1562.008↳ also matches DeleteTrail, StopLogging
AWSCloudTrail - Tampering to AWS CloudTrail logs source high: Detects successful attempts to disable, delete, or weaken AWS logging telemetry, including CloudTrail, CloudWatch/EventBridge, and VPC flow logs. This behavior can indicate defense evasion and deliberate reduction of incident visibility by an attacker.T1562, T1562.008↳ also matches DeleteTrail, StopLogging

YARA-L #

AWS CloudTrail Logging Tampered source high: Detects when CloudTrail logging is updated, stopped or deleted.T1562↳ also matches DeleteTrail, PutEventSelectors, StopLogging

Panther #

A CloudTrail Was Created or Updated source informational: A CloudTrail Trail was created, updated, or enabled.T1538↳ also matches CreateTrail, StartLogging

References #

Sample log: cado-security/AWS_EKS_Cluster_Forensics

AddTags

Service: cloudtrail

Description

Adds one or more tags to a trail, event data store, dashboard, or channel, up to a limit of 50.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "7953dd1b-4001-4f97-90bb-8f198700312c",
  "eventName": "AddTags",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3d942b88-f7cd-40ef-9586-5e9b94e6225d",
  "requestParameters": {
    "resourceId": "arn:aws:cloudtrail:us-west-1:123456789012:trail/dwfix-trail-kso9h1jb",
    "tagsList": [
      {
        "key": "env",
        "value": "dwfix"
      },
      {
        "key": "recipe",
        "value": "cloudtrail"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CancelQuery

Service: cloudtrail

Description

Cancels a query if the query is not in a terminated state, such as CANCELLED, FAILED, TIMED_OUT, or FINISHED.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "EventDataStoreNotFoundException",
  "errorMessage": "The event data store was not found.",
  "eventCategory": "Management",
  "eventID": "066766bc-d94f-428a-a783-ddb421555a66",
  "eventName": "CancelQuery",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T19:22:14Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "067ccaf5-c1a6-41d1-b07d-b6d39e58b0ca",
  "requestParameters": {
    "queryId": "dddddddddddddddddddddddddddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateChannel

Service: cloudtrail

Description

Creates a channel for CloudTrail to ingest events from a partner or external source.

CreateDashboard

Service: cloudtrail

Description

Creates a custom dashboard or the Highlights dashboard.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "c0585307-f9d0-4359-b676-95ad6b7d1fdd",
  "eventName": "CreateDashboard",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "83d810a0-6dce-40fc-b0ba-e9ba8772b8d0",
  "requestParameters": {
    "name": "dwfix-dash-kso9h1jb",
    "terminationProtectionEnabled": false
  },
  "responseElements": {
    "dashboardArn": "arn:aws:cloudtrail:us-west-1:123456789012:dashboard/dwfix-dash-kso9h1jb",
    "name": "dwfix-dash-kso9h1jb",
    "terminationProtectionEnabled": false,
    "type": "CUSTOM",
    "widgets": []
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateEventDataStore

Service: cloudtrail

Description

Creates a new event data store.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "CloudTrail Lake is no longer accepting new customers. Existing customers can continue to use their event data stores.",
  "eventCategory": "Management",
  "eventID": "b2c5e894-89b1-403e-a3ae-789a9c71332c",
  "eventName": "CreateEventDataStore",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d5d3dea0-b9c2-4186-910b-ab9981de4b83",
  "requestParameters": {
    "billingMode": "FIXED_RETENTION_PRICING",
    "name": "dwfix-eds-kso9h1jb",
    "retentionPeriod": 7,
    "startIngestion": false,
    "terminationProtectionEnabled": false
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteChannel

Service: cloudtrail

Description

Deletes a channel.

DeleteDashboard

Service: cloudtrail

Description

Deletes the specified dashboard.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "87fced35-8cdb-4d8c-b140-765ee5867505",
  "eventName": "DeleteDashboard",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ca6aacfc-f309-45ba-96f4-454b0f19c8be",
  "requestParameters": {
    "dashboardId": "arn:aws:cloudtrail:us-west-1:123456789012:dashboard/dwfix-dash-kso9h1jb"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteEventDataStore

Service: cloudtrail

Description

Disables the event data store specified by EventDataStore, which accepts an event data store ARN.

DeleteResourcePolicy

Service: cloudtrail

Description

Deletes the resource-based policy attached to the CloudTrail event data store, dashboard, or channel.

DeregisterOrganizationDelegatedAdmin

Service: cloudtrail

Description

Removes CloudTrail delegated administrator permissions from a member account in an organization.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value at 'delegatedAdminAccountId' failed to satisfy constraint: Member must satisfy regular expression pattern: \\d+",
  "eventCategory": "Management",
  "eventID": "70a266e6-0786-4f02-8bec-c51fb4cd8d6c",
  "eventName": "DeregisterOrganizationDelegatedAdmin",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T19:22:15Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b439fd30-4858-4707-8dbf-9b651b1992b7",
  "requestParameters": {
    "delegatedAdminAccountId": "dddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeQuery

Service: cloudtrail

Description

Returns metadata about a query, including query run time in milliseconds, number of events scanned and matched, and query status.

DisableFederation

Service: cloudtrail

Description

Disables Lake query federation on the specified event data store.

EnableFederation

Service: cloudtrail

Description

Enables Lake query federation on the specified event data store.

GenerateQuery

Service: cloudtrail

Description

Generates a query from a natural language prompt.

GetChannel

Service: cloudtrail

Description

Returns information about a specific channel.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "719bbd40-cedc-4762-bfd0-cd94f300e569",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventName": "GetChannel",
  "awsRegion": "ca-west-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "53fa98c6-5f1d-46a5-ac20-88b1ff40170b",
  "userAgent": "aws-sdk-dotnet-coreclr/4.0.6.0 ua/2.1 os/linux#6.1.176.221 md/ARCH#Arm64 lang/.NET_Core#10.0.10 exec-env/AWS_ECS_EC2 md/aws-sdk-dotnet-core#4.0.100.3 api/CloudTrail#4.0.6.0 md/ClientAsync cfg/init-coll#0 m/b,P,i,E",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.ca-west-1.amazonaws.com"
  }
}

GetDashboard

Service: cloudtrail

Description

Returns the specified dashboard.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "3e88034c-b1fc-468f-ad51-2b2a2c692206",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventName": "GetDashboard",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "26bb6c7c-2390-4547-b8fa-102bcf56b7af",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0",
  "errorCode": "ResourceNotFoundException",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com"
  }
}

GetEventConfiguration

Service: cloudtrail

Description

Retrieves the current event configuration settings for the specified event data store or trail.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterCombinationException",
  "errorMessage": "You must specify either a trail or an event data store.",
  "eventCategory": "Management",
  "eventID": "39e1df6a-bb41-4f35-beb6-c91296982936",
  "eventName": "GetEventConfiguration",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:31:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0e87109e-0e34-4a20-86a3-120d6c5185fe",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetEventDataStore

Service: cloudtrail

Description

Returns information about an event data store specified as either an ARN or the ID portion of the ARN.

GetEventSelectors

Service: cloudtrail

Description

Describes the settings for the event selectors that you configured for your trail.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "c289d324-db2c-45c2-97a5-93840c84fed2",
  "eventName": "GetEventSelectors",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:00:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "0182d1a5-db27-4156-a1b8-64a482bf9684",
  "requestParameters": {
    "trailName": "stratus-red-team-ctes-trail-qyxyekjbtk"
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_1d949e3e-4092-4c96-a6ef-96a967510a46 HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

GetImport

Service: cloudtrail

Description

Returns information about a specific import.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ImportNotFoundException",
  "errorMessage": "The import job dddddddddddddddddddddddddddddddddddd was not found.",
  "eventCategory": "Management",
  "eventID": "11c5e569-6f54-46cb-864c-2f672c0f270a",
  "eventName": "GetImport",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:43:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "50056f1c-53dc-4ca6-96bd-1782f0761cce",
  "requestParameters": {
    "importId": "dddddddddddddddddddddddddddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetInsightSelectors

Service: cloudtrail

Description

Describes the settings for the Insights event selectors that you configured for your trail or event data store.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "errorCode": "InsightNotEnabledException",
  "errorMessage": "Trail arn:aws:cloudtrail:us-east-2:797507667711:trail/management-events does not have Insights enabled. Edit the trail settings to enable Insights, and then try the operation again.",
  "eventCategory": "Management",
  "eventID": "fc3556f7-2a3f-4074-bfad-352ad92ace37",
  "eventName": "GetInsightSelectors",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2021-07-07T13:17:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "797507667711",
  "requestID": "904ea356-e65e-4487-ae6d-38065e041e1b",
  "requestParameters": {
    "trailName": "arn:aws:cloudtrail:us-east-2:797507667711:trail/management-events"
  },
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "213.205.197.162",
  "userAgent": "console.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIA3TLZJI37XXVQGUXV",
    "accountId": "797507667711",
    "arn": "arn:aws:iam::797507667711:user/bruce",
    "principalId": "AIDA3TLZJI372XH6M2Q25",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T11:45:11Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bruce"
  }
}

References #

Sample log: cado-security/AWS_EKS_Cluster_Forensics

GetQueryResults

Service: cloudtrail

Description

Gets event data results of a query.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "EventDataStoreNotFoundException",
  "errorMessage": "The event data store was not found.",
  "eventCategory": "Management",
  "eventID": "7f214e0a-46f6-4706-a185-e3781fdd5343",
  "eventName": "GetQueryResults",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:43:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "604440b7-cdc4-488c-b5f1-2430b7c1a947",
  "requestParameters": {
    "queryId": "dddddddddddddddddddddddddddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResourcePolicy

Service: cloudtrail

Description

Retrieves the JSON text of the resource-based policy document attached to the CloudTrail event data store, dashboard, or channel.

GetTrail

Service: cloudtrail

Description

Returns settings information for a specified trail.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: cloudtrail:GetTrail on resource: arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs",
  "eventID": "e8414e2b-3914-4179-b22d-d13c1f15acbd",
  "eventName": "GetTrail",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2020-03-12T02:47:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "7f0b848a-7b55-43c0-b006-e041773c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "9.93.96.159",
  "userAgent": "aws-cli/1.16.310 Python/3.7.3 Linux/5.0.0-38-generic botocore/1.13.46",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetTrailStatus

Service: cloudtrail

Description

Returns a JSON-formatted list of information about the specified trail.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "429feb58-9b7a-4b77-91c4-a9bd59e957ed",
  "eventName": "GetTrailStatus",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:00:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "8889a330-ee28-46f0-a762-11c30a5f0e2c",
  "requestParameters": {
    "name": "stratus-red-team-ctlr-trail-zqfsvooxqj"
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_4990da05-9399-449e-b49f-82996a764ec9 HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

ListChannels

Service: cloudtrail

Description

Lists the channels in the current account, and their source names.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "c9dc1c40-341b-4ff5-9588-cfcb40b29eeb",
  "eventName": "ListChannels",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:31:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "bb9cb497-9201-4f3c-822f-2de6c93b21bd",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDashboards

Service: cloudtrail

Description

Returns information about all dashboards in the account, in the current Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ccbc434f-f94d-405b-be7c-d17a25c233fb",
  "eventName": "ListDashboards",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:31:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "92531863-ecd3-48cb-9ab6-d8286f79dfbd",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListEventDataStores

Service: cloudtrail

Description

Returns information about all event data stores in the account, in the current Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "af166dc3-613b-4c02-9c4b-e6dffd464364",
  "eventName": "ListEventDataStores",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:31:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "bb6b7661-2b0b-48c9-8797-f0570ef1e744",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListImportFailures

Service: cloudtrail

Description

Returns a list of failures for the specified import.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "6b4b8b2c-322c-4097-9706-8513820e605d",
  "eventName": "ListImportFailures",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:43:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3ddfcd8d-1ca6-42af-ac69-fc4b77636dfc",
  "requestParameters": {
    "importId": "dddddddddddddddddddddddddddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListImports

Service: cloudtrail

Description

Returns information on all imports, or a select set of imports by ImportStatus or Destination.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "82fde1bd-fe3e-4966-9a9e-ad8e5c3e7de5",
  "eventName": "ListImports",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:31:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3b1873ba-8997-49f9-acfd-a5e185141d28",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListInsightsData

Service: cloudtrail

Description

Returns Insights events generated on a trail that logs data events.

ListInsightsMetricData

Service: cloudtrail

Description

Returns Insights metrics data for trails that have enabled Insights.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "2 validation errors detected: Value at 'eventSource' failed to satisfy constraint: Member must satisfy regular expression pattern: ^[a-z0-9_-]+\\.amazonaws\\.com$; Value at 'eventName' failed to satisfy constraint: Member must satisfy regular expression pattern: ^[A-Za-z0-9_]+$",
  "eventCategory": "Management",
  "eventID": "a818e9f4-547e-4308-9207-87d94bea6e1b",
  "eventName": "ListInsightsMetricData",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:43:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4b2c91cb-c102-46ba-a018-ddd09fac54aa",
  "requestParameters": {
    "eventName": "dw-probe",
    "eventSource": "dw-probe",
    "insightType": "ApiCallRateInsight"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListPublicKeys

Service: cloudtrail

Description

Returns all public keys whose private keys were used to sign the digest files within the specified time range.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: cloudtrail:ListPublicKeys",
  "eventID": "412b8785-2709-4fe0-9e2e-6f13682b1bfd",
  "eventName": "ListPublicKeys",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2017-03-11T18:20:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "76d176ef-0687-11e7-9d76-159d090925a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "34.7.241.251",
  "userAgent": "aws-cli/1.10.67 Python/2.7.10 Darwin/16.4.0 botocore/1.4.93",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListQueries

Service: cloudtrail

Description

Returns a list of queries and query statuses for the past seven days.

ListTags

Service: cloudtrail

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "afcf35d6-7ec8-4b99-b01f-31329a41241d",
  "eventName": "ListTags",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:00:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "4febfc03-db8a-4c21-bcec-5b966fc7a6de",
  "requestParameters": {
    "resourceIdList": [
      "arn:aws:cloudtrail:us-east-1:123837392027:trail/stratus-red-team-ctes-trail-qyxyekjbtk"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_1d949e3e-4092-4c96-a6ef-96a967510a46 HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

ListTrails

Service: cloudtrail

Description

Lists trails that are in the current account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: cloudtrail:ListTrails",
  "eventID": "a63af490-e654-453f-8028-2a1e0500db98",
  "eventName": "ListTrails",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2020-02-11T16:30:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "47b2189b-ec26-4e72-b44b-4d19c9010354",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "239.3.72.215",
  "userAgent": "aws-cli/1.17.10 Python/3.8.1 Darwin/19.2.0 botocore/1.14.10",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

PutEventConfiguration

Service: cloudtrail

Description

Updates the event configuration settings for the specified event data store or trail.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "Parameter is invalid",
  "eventCategory": "Management",
  "eventID": "29598456-1a08-4da7-99b6-0cc437ada806",
  "eventName": "PutEventConfiguration",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6e8fce56-8037-4395-ab25-a1fc8d111788",
  "requestParameters": {
    "maxEventSize": "Standard",
    "trailName": "dwfix-trail-kso9h1jb"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutInsightSelectors

Service: cloudtrail

Description

Lets you enable Insights event logging on specific event categories by specifying the Insights selectors that you want to enable on an existing trail or event data store.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "80a0325e-f2f3-4452-97e1-cd91ee2650ed",
  "eventName": "PutInsightSelectors",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e971d1c1-449a-4409-bda8-1783a42078c4",
  "requestParameters": {
    "insightSelectors": [
      {
        "insightType": "ApiCallRateInsight"
      }
    ],
    "trailName": "dwfix-trail-kso9h1jb"
  },
  "responseElements": {
    "insightSelectors": [
      {
        "eventCategories": [
          "Management"
        ],
        "insightType": "ApiCallRateInsight"
      }
    ],
    "trailARN": "arn:aws:cloudtrail:us-west-1:123456789012:trail/dwfix-trail-kso9h1jb"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutResourcePolicy

Service: cloudtrail

Description

Attaches a resource-based permission policy to a CloudTrail event data store, dashboard, or channel.

RegisterOrganizationDelegatedAdmin

Service: cloudtrail

Description

Registers an organization’s member account as the CloudTrail delegated administrator.

RemoveTags

Service: cloudtrail

Description

Removes the specified tags from a trail, event data store, dashboard, or channel.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "CloudTrailARNInvalidException",
  "errorMessage": "The ARN dw-probe is invalid.",
  "eventCategory": "Management",
  "eventID": "07907276-f789-41e4-8001-a9903b3b26a2",
  "eventName": "RemoveTags",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T19:22:15Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "983e7e16-7570-4d0b-9a49-00698ac4fddf",
  "requestParameters": {
    "resourceId": "dw-probe",
    "tagsList": [
      {
        "key": "ddddd"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RestoreEventDataStore

Service: cloudtrail

Description

Restores a deleted event data store specified by EventDataStore, which accepts an event data store ARN.

SearchSampleQueries

Service: cloudtrail

Description

Searches sample queries and returns a list of sample queries that are sorted by relevance.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "750c609e-1e24-478a-90ff-74441f8eda5d",
  "eventName": "SearchSampleQueries",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T18:43:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "79e29f89-8f8b-4d04-9bd2-72051530b7e7",
  "requestParameters": {
    "searchPhrase": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartDashboardRefresh

Service: cloudtrail

Description

Starts a refresh of the specified dashboard.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "The provided dashboard does not contain any widgets.",
  "eventCategory": "Management",
  "eventID": "fede7f07-c994-4c03-86d7-47039fefd88c",
  "eventName": "StartDashboardRefresh",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "df282e79-e9ee-4ae8-b64d-d01d49c65aa4",
  "requestParameters": {
    "dashboardId": "arn:aws:cloudtrail:us-west-1:123456789012:dashboard/dwfix-dash-kso9h1jb",
    "queryParameterValues": {}
  },
  "resources": [
    {
      "ARN": "arn:aws:cloudtrail:us-west-1:123456789012:dashboard/dwfix-dash-kso9h1jb",
      "accountId": "123456789012",
      "type": "AWS::CloudTrail::Dashboard"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartEventDataStoreIngestion

Service: cloudtrail

Description

Starts the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN.

StartImport

Service: cloudtrail

Description

Starts an import of logged trail events from a source S3 bucket to a destination event data store.

StartLogging

Service: cloudtrail

Description

Starts the recording of Amazon Web Services API calls and log file delivery for a trail.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "2f8e806b-355c-49fc-9ac6-7cea7d864938",
  "eventName": "StartLogging",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2023-07-10T12:00:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "53d6e726-1218-4f3b-83fd-2fc084b2160e",
  "requestParameters": {
    "name": "stratus-red-team-ctlr-trail-zqfsvooxqj"
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_4990da05-9399-449e-b49f-82996a764ec9 HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

A CloudTrail Was Created or Updated source informational: A CloudTrail Trail was created, updated, or enabled.T1538↳ also matches CreateTrail, UpdateTrail

References #

Sample log: invictus-ir/aws_dataset

StartQuery

Service: cloudtrail

Description

Starts a CloudTrail Lake query.

StopEventDataStoreIngestion

Service: cloudtrail

Description

Stops the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN.

StopImport

Service: cloudtrail

Description

Stops a specified import.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ImportNotFoundException",
  "errorMessage": "The import job dddddddddddddddddddddddddddddddddddd was not found.",
  "eventCategory": "Management",
  "eventID": "79e83382-7ea3-4dbd-a2f9-c5b5ee6f65d6",
  "eventName": "StopImport",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T19:22:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6722ef31-7d7a-48d2-be9a-9bb8e806c9b0",
  "requestParameters": {
    "importId": "dddddddddddddddddddddddddddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateChannel

Service: cloudtrail

Description

Updates a channel specified by a required channel ARN or UUID.

UpdateDashboard

Service: cloudtrail

Description

Updates the specified dashboard.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d8e156d0-211f-400b-9f5e-4f4fefb163f9",
  "eventName": "UpdateDashboard",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventTime": "2026-06-29T21:04:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "53f05699-64e6-47d8-b345-4c76914a7208",
  "requestParameters": {
    "dashboardId": "arn:aws:cloudtrail:us-west-1:123456789012:dashboard/dwfix-dash-kso9h1jb",
    "terminationProtectionEnabled": false
  },
  "responseElements": {
    "dashboardArn": "arn:aws:cloudtrail:us-west-1:123456789012:dashboard/dwfix-dash-kso9h1jb",
    "name": "dwfix-dash-kso9h1jb",
    "terminationProtectionEnabled": false,
    "type": "CUSTOM",
    "widgets": []
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudtrail.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateEventDataStore

Service: cloudtrail

Description

Updates an event data store.

ListServiceLinkedChannels

Service: cloudtrail

Description

ListServiceLinkedChannels recorded by CloudTrail for AWS CloudTrail. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "019bfe28-cf53-4d83-ab81-24847a157f50",
  "eventSource": "cloudtrail.amazonaws.com",
  "eventName": "ListServiceLinkedChannels",
  "awsRegion": "ca-central-1",
  "eventType": "AwsServiceEvent",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "34f35a71-7e0e-4be8-bcbf-0e907a0223a5",
  "userAgent": "inspector2.amazonaws.com"
}

AWS CloudTrail

any: AWS CloudTrail (catch-all)

Description

CreateTrail

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

Panther #

References #

DeleteTrail

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

References #

DescribeTrails

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

LookupEvents

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

PutEventSelectors

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

YARA-L #

Panther #

References #

StopLogging

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

References #

UpdateTrail

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

References #

AddTags

Description

Example CloudTrail Event #

CancelQuery

Description