EventBridge

eventName	Description	Sample	Rule
any	Catch-all entry for EventBridge rules that match the service but not a specific eventName.	N	N
DeleteRule	Permanently deletes an EventBridge rule, which stops the rule from matching incoming events and invoking its targets.	Y	Y
DisableRule	Disables an EventBridge rule so it no longer matches incoming events, without deleting the rule or its targets.	Y	Y
ActivateEventSource	Activates a partner event source that has been deactivated.	N	N
CancelReplay	Cancels the specified replay.	Y	N
CreateApiDestination	Creates an API destination, which is an HTTP invocation endpoint configured as a target for events.	Y	N
CreateArchive	Creates an archive of events with the specified settings.	Y	N
CreateConnection	Creates a connection.	Y	N
CreateEndpoint	Creates a global endpoint.	N	N
CreateEventBus	Creates a new event bus within your account.	Y	N
CreatePartnerEventSource	Called by an SaaS partner to create a partner event source.	N	N
DeactivateEventSource	You can use this operation to temporarily stop receiving events from the specified partner event source.	N	N
DeauthorizeConnection	Removes all authorization parameters from the connection.	Y	N
DeleteApiDestination	Deletes the specified API destination.	Y	N
DeleteArchive	Deletes the specified archive.	Y	N
DeleteConnection	Deletes a connection.	Y	N
DeleteEndpoint	Delete an existing global endpoint.	Y	N
DeleteEventBus	Deletes the specified custom event bus or partner event bus.	Y	Y
DeletePartnerEventSource	This operation is used by SaaS partners to delete a partner event source.	N	N
DescribeApiDestination	Retrieves details about an API destination.	Y	N
DescribeArchive	Retrieves details about an archive.	Y	N
DescribeConnection	Retrieves details about a connection.	Y	N
DescribeEndpoint	Get the information about an existing global endpoint.	Y	N
DescribeEventBus	Displays details about an event bus in your account.	Y	N
DescribeEventSource	This operation lists details about a partner event source that is shared with your account.	N	N
DescribePartnerEventSource	An SaaS partner can use this operation to list details about a partner event source that they have created.	N	N
DescribeReplay	Retrieves details about a replay.	Y	N
DescribeRule	Describes the details of the specified rule.	Y	N
EnableRule	Enables a rule.	Y	N
ListApiDestinations	Retrieves a list of API destination in the account in the current Region.	Y	N
ListArchives	Lists your archives.	Y	N
ListConnections	Retrieves a list of connections from the account.	Y	N
ListEndpoints	List the global endpoints associated with this account.	Y	N
ListEventBuses	Lists all the event buses in your account, including the default event bus, custom event buses, and partner event buses.	Y	N
ListEventSources	You can use this to see all the partner event sources that have been shared with your Amazon Web Services account.	Y	N
ListPartnerEventSourceAccounts	An SaaS partner can use this operation to display the Amazon Web Services account ID that a particular partner event source name is associated with.	N	N
ListPartnerEventSources	An SaaS partner can use this operation to list all the partner event source names that they have created.	N	N
ListReplays	Lists your replays.	Y	N
ListRuleNamesByTarget	Lists the names of the rules that the given target is put to.	Y	N
ListRules	Lists the Amazon CloudWatch Events rules in your account.	Y	N
ListTagsForResource	Displays the tags associated with an EventBridge resource.	N	N
ListTargetsByRule	Lists of targets assigned to the rule.	Y	N
PutEvents	Sends custom events to Amazon CloudWatch Events so that they can be matched to rules.	N	N
PutPartnerEvents	This is used by SaaS partners to write events to a customer's partner event bus.	N	N
PutPermission	Running PutPermission permits the specified Amazon Web Services account or Amazon Web Services organization to put events to the specified event bus.	Y	N
PutRule	Creates or updates a rule.	Y	N
PutTargets	Adds target(s) to a rule.	Y	N
RemovePermission	Revokes the permission of another Amazon Web Services account to be able to put events to the specified event bus.	Y	N
RemoveTargets	Removes target(s) from a rule so that when the rule is triggered, those targets will no longer be invoked.	Y	N
StartReplay	Starts the specified replay.	Y	N
TagResource	Assigns one or more tags (key-value pairs) to the specified EventBridge resource.	Y	N
TestEventPattern	Tests whether an event pattern matches the provided event.	Y	N
UntagResource	Removes one or more tags from the specified EventBridge resource.	Y	N
UpdateApiDestination	Updates an API destination.	Y	N
UpdateArchive	Updates the specified archive.	Y	N
UpdateConnection	Updates settings for a connection.	Y	N
UpdateEndpoint	Update an existing endpoint.	Y	N
UpdateEventBus	Updates the specified event bus.	Y	N

any: EventBridge (catch-all)

Service: events

Description

Catch-all entry for EventBridge rules that match the service but not a specific eventName.

DeleteRule

Service: events

Description

Permanently deletes an EventBridge rule, which stops the rule from matching incoming events and invoking its targets.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e7a168f2-cd10-4aa7-bd3e-9403cb47cd97",
  "eventName": "DeleteRule",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:12:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b2708ea0-b09a-4662-b859-669504add52e",
  "requestParameters": {
    "force": false,
    "name": "dwfix-rule"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS EventBridge Rule Disabled or Deleted source low: Identifies when an Amazon EventBridge rule is disabled or deleted. EventBridge rules are commonly used to automate operational workflows and security-relevant routing (for example, forwarding events to Lambda, SNS/SQS, or security tooling). Disabling or deleting a rule can break critical integrations, suppress detections, and reduce visibility. Adversaries may intentionally impair EventBridge rules to disrupt monitoring, delay response, or hide follow-on actions.T1489, T1562, T1562.001↳ also matches DisableRule

DisableRule

Service: events

Description

Disables an EventBridge rule so it no longer matches incoming events, without deleting the rule or its targets.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "07697d7e-0d61-4e24-85bc-a8d957749c79",
  "eventName": "DisableRule",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:12:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c163e1e0-8448-41e8-9735-855ca9ed9bd8",
  "requestParameters": {
    "name": "dwfix-rule"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS EventBridge Rule Disabled or Deleted source low: Identifies when an Amazon EventBridge rule is disabled or deleted. EventBridge rules are commonly used to automate operational workflows and security-relevant routing (for example, forwarding events to Lambda, SNS/SQS, or security tooling). Disabling or deleting a rule can break critical integrations, suppress detections, and reduce visibility. Adversaries may intentionally impair EventBridge rules to disrupt monitoring, delay response, or hide follow-on actions.T1489, T1562, T1562.001↳ also matches DeleteRule

Panther #

Account Security Configuration Changed source medium: An account wide security configuration was changed.T1562

ActivateEventSource

Service: events

Description

Activates a partner event source that has been deactivated.

CancelReplay

Service: events

Description

Cancels the specified replay.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Replay ddddd does not exist.",
  "eventCategory": "Management",
  "eventID": "c645bfdd-8f3f-4674-8dad-163b51ef663b",
  "eventName": "CancelReplay",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a7c79f7e-9bb2-4fd5-b1a1-7e3093bd6636",
  "requestParameters": {
    "replayName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateApiDestination

Service: events

Description

Creates an API destination, which is an HTTP invocation endpoint configured as a target for events.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0ddfccd0-47e0-475a-96f3-a106eccefbd5",
  "eventName": "CreateApiDestination",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "33283635-571d-424e-bd74-3b882cf42215",
  "requestParameters": {
    "connectionArn": "arn:aws:events:us-west-1:123456789012:connection/dwfix-conn-20260629205850/11cdf129-d93e-4a95-ab3d-094d185a5ff7",
    "description": "dwfix test api destination",
    "httpMethod": "POST",
    "invocationEndpoint": "https://httpbin.org/post",
    "invocationRateLimitPerSecond": 1,
    "name": "dwfix-dest-20260629205850"
  },
  "responseElements": {
    "apiDestinationArn": "arn:aws:events:us-west-1:123456789012:api-destination/dwfix-dest-20260629205850/4d46edec-c6cf-46b2-aa80-bb376b3c084a",
    "apiDestinationState": "ACTIVE",
    "creationTime": "2026-06-29T20:58:52Z",
    "lastModifiedTime": "2026-06-29T20:58:52Z"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateArchive

Service: events

Description

Creates an archive of events with the specified settings.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0715ffef-4a60-4a52-b510-40b5f53e0724",
  "eventName": "CreateArchive",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5246a632-a281-4747-86eb-cbcff3dc3eec",
  "requestParameters": {
    "archiveName": "dwfixarch20260629205850",
    "description": "dwfix archive",
    "eventSourceArn": "arn:aws:events:us-west-1:123456789012:event-bus/dwfix-eb-20260629205850",
    "retentionDays": 1
  },
  "responseElements": {
    "archiveArn": "arn:aws:events:us-west-1:123456789012:archive/dwfixarch20260629205850",
    "creationTime": "2026-06-29T20:58:51Z",
    "state": "ENABLED"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateConnection

Service: events

Description

Creates a connection.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0999f849-f274-44a1-8546-30e4c58e90a9",
  "eventName": "CreateConnection",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b12a42e7-8185-4bef-b9f2-f2125de22c82",
  "requestParameters": {
    "authParameters": {
      "apiKeyAuthParameters": {
        "apiKeyName": "x-api-key",
        "apiKeyValue": "HIDDEN_DUE_TO_SECURITY_REASONS"
      }
    },
    "authorizationType": "API_KEY",
    "description": "dwfix test connection",
    "name": "dwfix-conn-20260629205850"
  },
  "responseElements": {
    "connectionArn": "arn:aws:events:us-west-1:123456789012:connection/dwfix-conn-20260629205850/11cdf129-d93e-4a95-ab3d-094d185a5ff7",
    "connectionState": "AUTHORIZED",
    "creationTime": "2026-06-29T20:58:52Z",
    "lastModifiedTime": "2026-06-29T20:58:52Z"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateEndpoint

Service: events

Description

Creates a global endpoint.

CreateEventBus

Service: events

Description

Creates a new event bus within your account.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fe35245a-adce-4506-9d6d-a87b896a11c4",
  "eventName": "CreateEventBus",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bfca2510-3865-4179-b7ef-d68ece875f40",
  "requestParameters": {
    "description": "dwfix sample bus",
    "name": "dwfix-eb-20260629205850"
  },
  "responseElements": {
    "description": "dwfix sample bus",
    "eventBusArn": "arn:aws:events:us-west-1:123456789012:event-bus/dwfix-eb-20260629205850"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreatePartnerEventSource

Service: events

Description

Called by an SaaS partner to create a partner event source.

DeactivateEventSource

Service: events

Description

You can use this operation to temporarily stop receiving events from the specified partner event source.

DeauthorizeConnection

Service: events

Description

Removes all authorization parameters from the connection.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "2421bf55-9de5-494c-8d70-a7c1432a5905",
  "eventName": "DeauthorizeConnection",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "91e5a5b6-816b-4f31-95d9-341c5cd6905f",
  "requestParameters": {
    "name": "dwfix-conn-20260629205850"
  },
  "responseElements": {
    "connectionArn": "arn:aws:events:us-west-1:123456789012:connection/dwfix-conn-20260629205850/11cdf129-d93e-4a95-ab3d-094d185a5ff7",
    "connectionState": "DEAUTHORIZING",
    "creationTime": "2026-06-29T20:58:52Z",
    "lastAuthorizedTime": "2026-06-29T20:58:52Z",
    "lastModifiedTime": "2026-06-29T20:58:52Z"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteApiDestination

Service: events

Description

Deletes the specified API destination.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Failed to delete the api-destination(s). An api-destination 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "742de82b-7225-472f-9f43-3e90157a5055",
  "eventName": "DeleteApiDestination",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c7864c56-092b-4199-a049-601132686615",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteArchive

Service: events

Description

Deletes the specified archive.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Archive ddddd does not exist.",
  "eventCategory": "Management",
  "eventID": "67c7da0c-ee80-4b2b-86a9-0706c6e06198",
  "eventName": "DeleteArchive",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "480c990e-3b3c-4ea4-a7f6-fee652421c7b",
  "requestParameters": {
    "archiveName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteConnection

Service: events

Description

Deletes a connection.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Failed to delete the connection(s). Connection 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "03c49f70-0faf-4ad1-96bf-7d3279fc3362",
  "eventName": "DeleteConnection",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9642c623-3c6c-48d4-ad07-eff256367488",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteEndpoint

Service: events

Description

Delete an existing global endpoint.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "2fe85b49-6c1a-441d-8ccd-201796d33b33",
  "eventName": "DeleteEndpoint",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e84fa933-7c2d-41b3-bccb-90c999080c2e",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteEventBus

Service: events

Description

Deletes the specified custom event bus or partner event bus.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "999c349b-d08f-439b-80f9-29413bfea411",
  "eventName": "DeleteEventBus",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1d72d169-f8d1-4061-8fc5-32a9a38cbe21",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

AWSCloudTrail - Changes made to AWS CloudTrail logs source low: Identifies manipulation of AWS CloudTrail, CloudWatch/EventBridge, or VPC Flow Logs that can indicate defense evasion. This alert identifies any manipulation of AWS CloudTrail, Cloudwatch/EventBridge or VPC Flow logs. More Information: AWS CloudTrail API: https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_Operations.html AWS Cloudwatch/Eventbridge API: https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Operations.html AWS DelteteFlowLogs API : https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html 'T1070
AWSCloudTrail - Config Service Resource Deletion Attempts source low: Identifies AWS API calls that attempt to reduce logging or visibility in an account by stopping logging, deleting trails, deleting flow logs, or deleting event buses. This behavior can indicate defense evasion or the deliberate suppression of telemetry used to monitor security posture.T1562, T1562.008
AWSCloudTrail - Tampering to AWS CloudTrail logs source high: Detects successful attempts to disable, delete, or weaken AWS logging telemetry, including CloudTrail, CloudWatch/EventBridge, and VPC flow logs. This behavior can indicate defense evasion and deliberate reduction of incident visibility by an attacker.T1562, T1562.008

DeletePartnerEventSource

Service: events

Description

This operation is used by SaaS partners to delete a partner event source.

DescribeApiDestination

Service: events

Description

Retrieves details about an API destination.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Failed to describe the api-destination(s). An api-destination 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "ca547d88-7309-43a3-9402-954162bfcebe",
  "eventName": "DescribeApiDestination",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "055a11e1-7d6b-4fdb-950f-f3238b7e6f52",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeArchive

Service: events

Description

Retrieves details about an archive.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Archive ddddd does not exist.",
  "eventCategory": "Management",
  "eventID": "71f16149-388a-4e7a-8228-96547650bc4e",
  "eventName": "DescribeArchive",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3584d8e0-be7c-4c20-9382-85b98a56e1da",
  "requestParameters": {
    "archiveName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeConnection

Service: events

Description

Retrieves details about a connection.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Failed to describe the connection(s). Connection 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "1c3f1eb8-72d2-4aad-a972-704e59f99288",
  "eventName": "DescribeConnection",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "deadb30b-7680-43e2-b7c6-8907efd1010b",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeEndpoint

Service: events

Description

Get the information about an existing global endpoint.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "UnknownError",
  "errorMessage": "An unknown error occurred",
  "eventCategory": "Management",
  "eventID": "137a94ab-acba-44c7-a42c-7ab7083d425c",
  "eventName": "DescribeEndpoint",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3e0a8a3a-bcc7-487d-b39f-6c0ede810319",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeEventBus

Service: events

Description

Displays details about an event bus in your account.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "ap-south-1",
  "eventID": "4b7364ae-6f30-44c9-b6aa-584bf8fa78c7",
  "eventName": "DescribeEventBus",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2018-08-05T17:10:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "65bb7cb9-98d2-11e8-af1a-ce9e09aa8a09",
  "requestParameters": null,
  "responseElements": {
    "arn": "arn:aws:events:ap-south-1:811596193553:event-bus/default",
    "name": "default"
  },
  "sourceIPAddress": "250.251.253.3",
  "userAgent": "Boto3/1.5.32 Python/3.6.4 Darwin/17.6.0 Botocore/1.8.50",
  "userIdentity": {
    "accessKeyId": "ASIAPYBUDZE3ZQU169GB",
    "accountId": "811596193553",
    "arn": "arn:aws:sts::811596193553:assumed-role/SummitRouteAudit/4032461535040776536",
    "principalId": "AROAMY611GPC0EPB1P0F9:4032461535040776536",
    "sessionContext": {
      "attributes": {
        "creationDate": "2018-08-05T17:00:49Z",
        "mfaAuthenticated": "true"
      },
      "sessionIssuer": {
        "accountId": "811596193553",
        "arn": "arn:aws:iam::811596193553:role/SummitRouteAudit",
        "principalId": "AROAMY611GPC0EPB1P0F9",
        "type": "Role",
        "userName": "SummitRouteAudit"
      }
    },
    "type": "AssumedRole"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeEventSource

Service: events

Description

This operation lists details about a partner event source that is shared with your account.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "2b9896ae-c6ba-4d1e-b545-051532576e36",
  "eventSource": "events.amazonaws.com",
  "eventName": "DescribeEventSource",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2015-10-07",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "29c70062-326c-4109-937b-d7707f046672",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-east-1.amazonaws.com"
  }
}

DescribePartnerEventSource

Service: events

Description

An SaaS partner can use this operation to list details about a partner event source that they have created.

DescribeReplay

Service: events

Description

Retrieves details about a replay.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Replay ddddd does not exist.",
  "eventCategory": "Management",
  "eventID": "2353f149-8b4d-4e42-803e-28b0246bcf96",
  "eventName": "DescribeReplay",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "51480265-85db-467b-99f3-1e73579e4451",
  "requestParameters": {
    "replayName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeRule

Service: events

Description

Describes the details of the specified rule.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "UnknownError",
  "errorMessage": "An unknown error occurred",
  "eventCategory": "Management",
  "eventID": "f5de8085-a50a-4dd1-b0d8-38989810be23",
  "eventName": "DescribeRule",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e089fd77-8c15-4eca-ba18-7069b895047b",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

EnableRule

Service: events

Description

Enables a rule.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5e0e1519-2f76-4e54-b599-f893ae5a876b",
  "eventName": "EnableRule",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:12:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "33671805-ac49-49aa-8fcb-70c4673bcc83",
  "requestParameters": {
    "name": "dwfix-rule"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListApiDestinations

Service: events

Description

Retrieves a list of API destination in the account in the current Region.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "73ebf268-8572-4e55-92f9-5040deea1748",
  "eventName": "ListApiDestinations",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:31:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ada6fc8c-d0bb-46c8-a2b3-fb431f90f432",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListArchives

Service: events

Description

Lists your archives.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "1615478d-686f-455b-8ad0-8c85ba10da7d",
  "eventName": "ListArchives",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:31:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a125afa0-0c63-45fb-aff6-156e54bfaaf1",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListConnections

Service: events

Description

Retrieves a list of connections from the account.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "eb370756-e354-46ef-afa1-c3eb9c9af690",
  "eventName": "ListConnections",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:31:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5e1d1e2d-b0ce-4299-b34c-7c7c8f75cd3c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListEndpoints

Service: events

Description

List the global endpoints associated with this account.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8d109852-8fcf-4f0e-9bd9-fa86a0d8093d",
  "eventName": "ListEndpoints",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:31:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5bd5aa41-db6c-4043-83a4-3f659ad08620",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListEventBuses

Service: events

Description

Lists all the event buses in your account, including the default event bus, custom event buses, and partner event buses.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: events:ListEventBuses on resource: arn:aws:events:us-east-1:811596193553:event-bus/*",
  "eventID": "a85500a1-b112-43f4-807f-a1db983599a2",
  "eventName": "ListEventBuses",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2020-06-10T05:35:15Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "ccb5ec31-cdc6-4938-8ddf-504e6bc58aa2",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListEventSources

Service: events

Description

You can use this to see all the partner event sources that have been shared with your Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: events:ListEventSources on resource: arn:aws:events:us-east-1::event-source/*",
  "eventID": "677f78a0-aa4a-494d-8c95-01cbb8658cbb",
  "eventName": "ListEventSources",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2020-06-10T05:35:15Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "b60ebdc7-0bc0-45d9-8903-c25fd5be2554",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListPartnerEventSourceAccounts

Service: events

Description

An SaaS partner can use this operation to display the Amazon Web Services account ID that a particular partner event source name is associated with.

ListPartnerEventSources

Service: events

Description

An SaaS partner can use this operation to list all the partner event source names that they have created.

ListReplays

Service: events

Description

Lists your replays.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5072d5bc-14c0-4254-9e1c-89fb48093900",
  "eventName": "ListReplays",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:31:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0f611c61-8814-499b-a4eb-babe9cfe170b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListRuleNamesByTarget

Service: events

Description

Lists the names of the rules that the given target is put to.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "bf8bf46e-608f-4df3-95e6-81005969472a",
  "eventName": "ListRuleNamesByTarget",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2ef133c5-ce64-4e87-853d-ab2557c53fb7",
  "requestParameters": {
    "targetArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListRules

Service: events

Description

Lists the Amazon CloudWatch Events rules in your account.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "24a1ee0b-2865-4a73-b811-fcc355c271d4",
  "eventName": "ListRules",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2021-04-13T13:29:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "760111141337",
  "requestID": "a54ea06d-69b5-4679-97ef-de47621b4891",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "95.9.125.40",
  "userAgent": "Boto3/1.14.6 Python/3.9.4 Darwin/20.3.0 Botocore/1.17.6",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLIXX7QSZR",
    "accountId": "760111141337",
    "arn": "arn:aws:iam::760111141337:user/cloudmapper",
    "principalId": "AIDAYTOGP2RLK32EB7QZV",
    "type": "IAMUser",
    "userName": "cloudmapper"
  }
}

References #

Sample log: splunk/attack_data

ListTagsForResource

Service: events

Description

Displays the tags associated with an EventBridge resource.

ListTargetsByRule

Service: events

Description

Lists of targets assigned to the rule.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "UnknownError",
  "errorMessage": "An unknown error occurred",
  "eventCategory": "Management",
  "eventID": "b742d4d8-4fbd-4b89-84f2-64f761d7d48c",
  "eventName": "ListTargetsByRule",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T18:43:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "57618c88-a27d-4911-8e32-3907443cc19a",
  "requestParameters": {
    "rule": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutEvents

Service: events

Description

Sends custom events to Amazon CloudWatch Events so that they can be matched to rules.

PutPartnerEvents

Service: events

Description

This is used by SaaS partners to write events to a customer's partner event bus.

PutPermission

Service: events

Description

Running PutPermission permits the specified Amazon Web Services account or Amazon Web Services organization to put events to the specified event bus.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "6f9b3b26-3ee4-4563-ac2b-04cffb61e5f3",
  "eventName": "PutPermission",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "609cf655-8e04-4cb2-bf52-75e21248b520",
  "requestParameters": {
    "action": "events:PutEvents",
    "appendPolicyStatements": false,
    "eventBusName": "dwfix-eb-20260629205850",
    "principal": "123456789012",
    "statementId": "dwfixstmt20260629205850"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutRule

Service: events

Description

Creates or updates a rule.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: events:PutRule on resource: arn:aws:events:us-east-1:811596193553:rule/bdc-dnsmonitoring-scheduled-rule",
  "eventID": "733f8377-ebf8-4d8c-a325-10af29083c",
  "eventName": "PutRule",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2019-07-02T17:15:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "f15ed6e4-9cec-11e9-a45e-132905ad8d32",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "62.194.5.3",
  "userAgent": "aws-cli/1.14.44 Python/3.6.7 Linux/4.15.0-51-generic botocore/1.8.48",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

PutTargets

Service: events

Description

Adds target(s) to a rule.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "RoleArn is required for target arn:aws:events:us-west-1:123456789012:event-bus/default.",
  "eventCategory": "Management",
  "eventID": "5144950a-2acf-4168-9aa5-74c901fdf80d",
  "eventName": "PutTargets",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0d57cafe-760a-4917-a56c-4818ded47dc1",
  "requestParameters": {
    "eventBusName": "dwfix-eb-20260629205850",
    "rule": "dwfix-rule-20260629205850",
    "targets": [
      {
        "arn": "arn:aws:events:us-west-1:123456789012:event-bus/default",
        "id": "t1"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RemovePermission

Service: events

Description

Revokes the permission of another Amazon Web Services account to be able to put events to the specified event bus.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "Parameter(s) StatementId must be specified.",
  "eventCategory": "Management",
  "eventID": "9e6acc26-2f61-47ac-8242-18eb5bf115d5",
  "eventName": "RemovePermission",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:45:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "28a98a16-4e5a-487e-805f-ee6b3407a13b",
  "requestParameters": {
    "removeAllPermissions": false
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RemoveTargets

Service: events

Description

Removes target(s) from a rule so that when the rule is triggered, those targets will no longer be invoked.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "UnknownError",
  "errorMessage": "An unknown error occurred",
  "eventCategory": "Management",
  "eventID": "7d56431f-50fb-412e-aec6-adf68a7bb0ba",
  "eventName": "RemoveTargets",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f4edddc6-e154-46ca-892e-19529d6e0278",
  "requestParameters": {
    "force": false,
    "ids": [
      "ddddd"
    ],
    "rule": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartReplay

Service: events

Description

Starts the specified replay.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "56469feb-5758-424f-bb9f-2290e31e1679",
  "eventName": "StartReplay",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c194c10f-74e9-4505-9094-8ccdd5bb0505",
  "requestParameters": {
    "description": "dwfix test replay",
    "destination": {
      "arn": "arn:aws:events:us-west-1:123456789012:event-bus/dwfix-eb-20260629205850"
    },
    "eventEndTime": "2026-06-29T20:58:52Z",
    "eventSourceArn": "arn:aws:events:us-west-1:123456789012:archive/dwfixarch20260629205850",
    "eventStartTime": "2026-06-29T20:53:52Z",
    "replayName": "dwfix-rpl-20260629205850"
  },
  "responseElements": {
    "replayArn": "arn:aws:events:us-west-1:123456789012:replay/dwfix-rpl-20260629205850",
    "replayStartTime": "2026-06-29T20:58:52Z",
    "state": "STARTING"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: events

Description

Assigns one or more tags (key-value pairs) to the specified EventBridge resource.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "2a998a7e-ee85-4d02-b375-b2cff984848c",
  "eventName": "TagResource",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:12:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8947fee3-7e1e-496c-b166-c66ae3e880ce",
  "requestParameters": {
    "resourceARN": "arn:aws:events:us-west-1:123456789012:rule/dwfix-rule",
    "tags": [
      {
        "key": "dw",
        "value": "f"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TestEventPattern

Service: events

Description

Tests whether an event pattern matches the provided event.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "90078bab-cf39-40e1-ade4-2e7211d81099",
  "eventName": "TestEventPattern",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "8f2481d2-365e-4c7d-a681-35cefd34fa50",
  "requestParameters": {
    "event": {
      "id": "dwfix-00000000-0000-0000-0000-000000000001",
      "version": "0",
      "account": "123456789012",
      "time": "2026-06-29T20:58:52Z",
      "region": "us-west-1",
      "resources": [],
      "source": "dwfix.test",
      "detail-type": "DwfixTestEvent",
      "detail": {}
    },
    "eventPattern": {
      "source": [
        "dwfix.test"
      ]
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: events

Description

Removes one or more tags from the specified EventBridge resource.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b85a68ea-46ab-4cb0-9595-0266aa73762f",
  "eventName": "UntagResource",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:12:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6da301f2-1747-4ef8-ac67-33c7f69b1ac9",
  "requestParameters": {
    "resourceARN": "arn:aws:events:us-west-1:123456789012:rule/dwfix-rule",
    "tagKeys": [
      "dw"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateApiDestination

Service: events

Description

Updates an API destination.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Failed to update the api-destination(s). An api-destination 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "0193a65b-3506-4d78-b5da-a679c439a590",
  "eventName": "UpdateApiDestination",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "88e0f084-3903-4da6-bde1-e39b0dba301d",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateArchive

Service: events

Description

Updates the specified archive.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "At least one of EventPattern, RetentionDays or Description must be provided.",
  "eventCategory": "Management",
  "eventID": "d2299e41-f655-4f1d-a40f-d7458fd536fd",
  "eventName": "UpdateArchive",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5d2cecd5-e628-412d-958f-1c77b5319b7d",
  "requestParameters": {
    "archiveName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateConnection

Service: events

Description

Updates settings for a connection.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Failed to update the connection(s). Connection 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "75f7ea56-4307-4c0e-ba3a-0ebedcd05144",
  "eventName": "UpdateConnection",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a61af9ac-30d9-4d61-97a0-315774d49309",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateEndpoint

Service: events

Description

Update an existing endpoint.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "errorCode": "UnknownError",
  "errorMessage": "An unknown error occurred",
  "eventCategory": "Management",
  "eventID": "bbd00062-d3f5-4dd1-a3d0-a183380bc872",
  "eventName": "UpdateEndpoint",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T19:23:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3dfe8f83-362e-4bcc-b75d-7e4707fb1119",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateEventBus

Service: events

Description

Updates the specified event bus.

Example CloudTrail Event #

{
  "apiVersion": "2015-10-07",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "23d71d63-087a-48c7-bd61-b9909b9e979a",
  "eventName": "UpdateEventBus",
  "eventSource": "events.amazonaws.com",
  "eventTime": "2026-06-29T20:58:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "dfb0ea14-023e-486e-91b8-eea492317dd2",
  "requestParameters": {
    "description": "dwfix sample bus - updated",
    "name": "dwfix-eb-20260629205850"
  },
  "responseElements": {
    "arn": "arn:aws:events:us-west-1:123456789012:event-bus/dwfix-eb-20260629205850",
    "description": "dwfix sample bus - updated",
    "name": "dwfix-eb-20260629205850"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "events.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

EventBridge

any: EventBridge (catch-all)

Description

DeleteRule

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

DisableRule

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

Panther #

ActivateEventSource

Description

CancelReplay

Description

Example CloudTrail Event #

CreateApiDestination

Description

Example CloudTrail Event #

CreateArchive

Description

Example CloudTrail Event #

CreateConnection

Description

Example CloudTrail Event #

CreateEndpoint

Description

CreateEventBus

Description

Example CloudTrail Event #

CreatePartnerEventSource

Description

DeactivateEventSource

Description

DeauthorizeConnection

Description

Example CloudTrail Event #

DeleteApiDestination

Description

Example CloudTrail Event #

DeleteArchive

Description

Example CloudTrail Event #

DeleteConnection

Description

Example CloudTrail Event #

DeleteEndpoint

Description

Example CloudTrail Event #

DeleteEventBus

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Kusto #

DeletePartnerEventSource

Description

DescribeApiDestination

Description

Example CloudTrail Event #

DescribeArchive

Description

Example CloudTrail Event #

DescribeConnection

Description

Example CloudTrail Event #

DescribeEndpoint

Description

Example CloudTrail Event #

DescribeEventBus

Description

Example CloudTrail Event #

References #

DescribeEventSource

Description