CloudWatch

eventName	Description	Sample	Rule
any	Catch-all entry for CloudWatch rules that match the service but not a specific eventName.	N	N
DeleteAlarms	Deletes the specified CloudWatch alarms, including composite and standard metric alarms.	Y	Y
AssociateDatasetKmsKey	Associates an Amazon Web Services Key Management Service (Amazon Web Services KMS) customer managed key with the specified dataset.	N	N
DeleteAlarmMuteRule	Deletes a specific alarm mute rule.	Y	N
DeleteAnomalyDetector	Deletes the specified anomaly detection model from your account.	Y	N
DeleteDashboards	Deletes all dashboards that you specify.	Y	N
DeleteInsightRules	Permanently deletes the specified Contributor Insights rules.	Y	N
DeleteMetricStream	Permanently deletes the metric stream that you specify.	Y	N
DescribeAlarmContributors	Returns the information of the current alarm contributors that are in ALARM state.	Y	N
DescribeAlarmHistory	Retrieves the history for the specified alarm.	Y	N
DescribeAlarms	Retrieves the specified alarms.	Y	N
DescribeAlarmsForMetric	Retrieves the alarms for the specified metric.	Y	N
DescribeAnomalyDetectors	Lists the anomaly detection models that you have created in your account.	Y	N
DescribeInsightRules	Returns a list of all the Contributor Insights rules in your account.	Y	N
DisableAlarmActions	Disables the actions for the specified alarms.	Y	N
DisableInsightRules	Disables the specified Contributor Insights rules.	Y	N
DisassociateDatasetKmsKey	Removes the customer managed Amazon Web Services Key Management Service (Amazon Web Services KMS) key association from the specified dataset.	Y	N
EnableAlarmActions	Enables the actions for the specified alarms.	Y	N
EnableInsightRules	Enables the specified Contributor Insights rules.	Y	N
GetAlarmMuteRule	Retrieves details for a specific alarm mute rule.	Y	N
GetDashboard	Displays the details of the dashboard that you specify.	Y	N
GetDataset	Returns information about the specified dataset.	Y	N
GetInsightRuleReport	This operation returns the time series data collected by a Contributor Insights rule.	Y	N
GetMetricData	You can use the GetMetricData API to retrieve CloudWatch metric values.	N	N
GetMetricStatistics	Gets statistics for the specified metric.	N	N
GetMetricStream	Returns information about the metric stream that you specify.	Y	N
GetMetricWidgetImage	You can use the GetMetricWidgetImage API to retrieve a snapshot graph of one or more Amazon CloudWatch metrics as a bitmap image.	N	N
GetOTelEnrichment	Returns the current status of vended metric enrichment for the account, including whether CloudWatch vended metrics are enriched with resource ARN and resource tag labels and queryable using PromQL.	Y	N
ListAlarmMuteRules	Lists alarm mute rules in your Amazon Web Services account and region.	Y	N
ListDashboards	Returns a list of the dashboards for your account.	Y	N
ListManagedInsightRules	Returns a list that contains the number of managed Contributor Insights rules in your account.	Y	N
ListMetrics	List the specified metrics.	N	N
ListMetricStreams	Returns a list of metric streams in this account.	Y	N
ListTagsForResource	Displays the tags associated with a CloudWatch resource.	N	N
PutAlarmMuteRule	Creates or updates an alarm mute rule.	Y	N
PutAnomalyDetector	Creates an anomaly detection model for a CloudWatch metric.	Y	N
PutCompositeAlarm	Creates or updates a composite alarm.	Y	N
PutDashboard	Creates a dashboard if it does not already exist, or updates an existing dashboard.	Y	N
PutInsightRule	Creates a Contributor Insights rule.	Y	N
PutManagedInsightRules	Creates a managed Contributor Insights rule for a specified Amazon Web Services resource.	Y	N
PutMetricAlarm	Creates or updates an alarm and associates it with the specified metric, metric math expression, anomaly detection model, Metrics Insights query, or PromQL query.	Y	N
PutMetricData	Publishes metric data to Amazon CloudWatch.	N	N
PutMetricStream	Creates or updates a metric stream.	N	N
SetAlarmState	Temporarily sets the state of an alarm for testing purposes.	Y	N
StartMetricStreams	Starts the streaming of metrics for one or more of your metric streams.	N	N
StartOTelEnrichment	Enables enrichment and PromQL access for CloudWatch vended metrics for supported Amazon Web Services resources in the account.	Y	N
StopMetricStreams	Stops the streaming of metrics for one or more of your metric streams.	Y	N
StopOTelEnrichment	Disables enrichment and PromQL access for CloudWatch vended metrics for supported Amazon Web Services resources in the account.	Y	N
TagResource	Assigns one or more tags (key-value pairs) to the specified CloudWatch resource.	Y	N
UntagResource	Removes one or more tags from the specified resource.	Y	N
GetOTelEnrichmentConfiguration	GetOTelEnrichmentConfiguration recorded by CloudTrail for Amazon CloudWatch. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
PutLogAlarm	Creates or updates a log alarm.	N	N

any: CloudWatch (catch-all)

Service: monitoring

Description

Catch-all entry for CloudWatch rules that match the service but not a specific eventName.

DeleteAlarms

Service: monitoring

Description

Deletes the specified CloudWatch alarms, including composite and standard metric alarms.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "a084e28d-51a0-47f4-9252-50ddf11fbc51",
  "eventName": "DeleteAlarms",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "caeac2be-4b39-4fb1-a462-2244d8ad1307",
  "requestParameters": {
    "alarmNames": [
      "ddddd"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS CloudWatch Alarm Deletion source medium: Detects the deletion of one or more Amazon CloudWatch alarms using the "DeleteAlarms" API. CloudWatch alarms are critical for monitoring metrics and triggering alerts when thresholds are exceeded. An adversary may delete alarms to impair visibility, silence alerts, and evade detection following malicious activity. This behavior may occur during post-exploitation or cleanup phases to remove traces of compromise or disable automated responses.T1562, T1562.001, T1562.006

Splunk #

ASL AWS Defense Evasion Impair Security Services source: The following analytic detects the deletion of critical AWS Security Services configurations, such as CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules. It leverages Amazon Security Lake logs to identify specific…T1685, T1685.002

AssociateDatasetKmsKey

Service: monitoring

Description

Associates an Amazon Web Services Key Management Service (Amazon Web Services KMS) customer managed key with the specified dataset.

DeleteAlarmMuteRule

Service: monitoring

Description

Deletes a specific alarm mute rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fbb06999-fe0c-4397-9549-180af13a17c3",
  "eventName": "DeleteAlarmMuteRule",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4a409f15-c709-404d-b0b4-c795592e9cfa",
  "requestParameters": {
    "alarmMuteRuleName": "ddddd"
  },
  "resources": [
    {
      "ARN": "arn:aws:cloudwatch:us-west-1:123456789012:alarm-mute-rule:ddddd",
      "accountId": "123456789012",
      "type": "AWS::CloudWatch::AlarmMuteRule"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteAnomalyDetector

Service: monitoring

Description

Deletes the specified anomaly detection model from your account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "MissingRequiredParameterException",
  "errorMessage": "Input missing required parameter.",
  "eventCategory": "Management",
  "eventID": "8213deff-3c8e-4ea3-a0fc-718d52d3db85",
  "eventName": "DeleteAnomalyDetector",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:45:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ff28b12b-b424-461a-a7c7-07f87ce5d86f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteDashboards

Service: monitoring

Description

Deletes all dashboards that you specify.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "a01d253e-9a3a-4f59-ab6d-4b7988aa5a11",
  "eventName": "DeleteDashboards",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "59f86c21-abda-4b55-8219-06eae89a2641",
  "requestParameters": {
    "dashboardNames": [
      "dw-probe"
    ]
  },
  "resources": [
    {
      "type": "AWS::CloudWatch::Metric"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteInsightRules

Service: monitoring

Description

Permanently deletes the specified Contributor Insights rules.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ea69e1c9-41bf-49dd-8bf0-0f3c3f29c28e",
  "eventName": "DeleteInsightRules",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4b8eac46-0f7a-46b8-a5c9-92e1d48f0c09",
  "requestParameters": {
    "ruleNames": [
      "ddddd"
    ]
  },
  "responseElements": {
    "failures": []
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteMetricStream

Service: monitoring

Description

Permanently deletes the metric stream that you specify.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "1e4cb641-a2b9-4abd-9da5-7dac076ea469",
  "eventName": "DeleteMetricStream",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f2744f3c-7a30-413d-b33e-e102132e4035",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeAlarmContributors

Service: monitoring

Description

Returns the information of the current alarm contributors that are in ALARM state.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "No alarm for name ddddd was found",
  "eventCategory": "Management",
  "eventID": "23dc3fe9-6511-4b34-bc94-32e455b3be40",
  "eventName": "DescribeAlarmContributors",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:45:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "79de41eb-1799-465d-897c-5744e99a6eee",
  "requestParameters": {
    "alarmName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeAlarmHistory

Service: monitoring

Description

Retrieves the history for the specified alarm.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventID": "af20fcf4-76fe-4f7c-863e-593bd9e4dc9d",
  "eventName": "DescribeAlarmHistory",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2017-10-06T22:14:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.04",
  "recipientAccountId": "811596193553",
  "requestID": "c38c4fbe-aae3-11e7-90ae-dd19f8946ed1",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "146.1.242.155",
  "userAgent": "aws-cli/1.11.166 Python/3.6.2 Darwin/16.7.0 botocore/1.7.24",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeAlarms

Service: monitoring

Description

Retrieves the specified alarms.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "3d34e888-731a-44cd-8a74-a6d244d1f3d5",
  "eventName": "DescribeAlarms",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2023-07-10T12:28:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "23ecbcc3-6e08-4d28-95fb-d8100a6ac760",
  "requestParameters": {
    "maxRecords": 100
  },
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "10.8.8.10",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSCS5BLNV76",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T12:27:45Z",
        "mfaAuthenticated": "true"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

DescribeAlarmsForMetric

Service: monitoring

Description

Retrieves the alarms for the specified metric.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarmsForMetric",
  "eventID": "1c478c67-aec9-476a-a337-0b7837c16d4b",
  "eventName": "DescribeAlarmsForMetric",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2019-03-09T15:52:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "5858e3bd-4283-11e9-8bbc-7f5313bc007b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.46.250.216",
  "userAgent": "aws-cli/1.15.45 Python/2.7.12 Linux/4.4.0-66-generic botocore/1.10.45",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeAnomalyDetectors

Service: monitoring

Description

Lists the anomaly detection models that you have created in your account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAnomalyDetectors",
  "eventID": "85bba86b-fa40-450a-9a61-f109246c45d79",
  "eventName": "DescribeAnomalyDetectors",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2020-06-10T05:32:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "590f4f69-8831-4971-9555-963518ba08",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeInsightRules

Service: monitoring

Description

Returns a list of all the Contributor Insights rules in your account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "3485db5a-7614-4a80-8041-25e9e842267e",
  "eventName": "DescribeInsightRules",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2021-07-07T13:08:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "797507667711",
  "requestID": "83cf5669-885e-466c-a14a-98b6dabd01f2",
  "requestParameters": null,
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "213.205.197.162",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:89.0) Gecko/20100101 Firefox/89.0",
  "userIdentity": {
    "accessKeyId": "ASIA3TLZJI37TRWHLD2C",
    "accountId": "797507667711",
    "arn": "arn:aws:iam::797507667711:user/bruce",
    "principalId": "AIDA3TLZJI372XH6M2Q25",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T11:45:11Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bruce"
  }
}

References #

Sample log: cado-security/AWS_EKS_Cluster_Forensics

DisableAlarmActions

Service: monitoring

Description

Disables the actions for the specified alarms.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "615ac3b8-d585-478d-b9f7-fac967ed3dc6",
  "eventName": "DisableAlarmActions",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3a0f4e0e-f90b-47a8-bc48-d5cbc54950a3",
  "requestParameters": {
    "alarmNames": [
      "ddddd"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisableInsightRules

Service: monitoring

Description

Disables the specified Contributor Insights rules.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "71d6d3ea-d506-4104-aee3-f8e04725fe44",
  "eventName": "DisableInsightRules",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3df94d54-0267-4760-8751-1e97781dd55b",
  "requestParameters": {
    "ruleNames": [
      "ddddd"
    ]
  },
  "responseElements": {
    "failures": [
      {
        "exceptionType": "ResourceNotFoundException",
        "failureCode": "RULE_NAME",
        "failureDescription": "Rule ddddd does not exist.",
        "failureResource": "ddddd"
      }
    ]
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateDatasetKmsKey

Service: monitoring

Description

Removes the customer managed Amazon Web Services Key Management Service (Amazon Web Services KMS) key association from the specified dataset.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'datasetIdentifier' failed to satisfy constraint: Member must satisfy regular expression pattern: (default|arn:[a-zA-Z0-9-]+:cloudwatch:[a-zA-Z0-9-]*:\\d{12}:dataset/default)",
  "eventCategory": "Management",
  "eventID": "246d70c0-1618-4f1d-be0a-48e52b0691e3",
  "eventName": "DisassociateDatasetKmsKey",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "da4b5d54-c1ea-4931-9417-66561205acb4",
  "requestParameters": {
    "datasetIdentifier": "ddddd"
  },
  "resources": [
    {
      "type": "AWS::CloudWatch::Dataset"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

EnableAlarmActions

Service: monitoring

Description

Enables the actions for the specified alarms.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ce32646a-c534-48f0-8395-a0d036fbaeaa",
  "eventName": "EnableAlarmActions",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "33605948-8821-430d-8d4d-f5213f97874f",
  "requestParameters": {
    "alarmNames": [
      "dwfix-cw-metric-alarm"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

EnableInsightRules

Service: monitoring

Description

Enables the specified Contributor Insights rules.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3b796a5b-9e3e-4274-96d0-321eee6b03b7",
  "eventName": "EnableInsightRules",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5590aa92-9036-4dd0-8fa6-a0b56b471247",
  "requestParameters": {
    "ruleNames": [
      "dwfix-cw-insight-rule"
    ]
  },
  "responseElements": {
    "failures": []
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAlarmMuteRule

Service: monitoring

Description

Retrieves details for a specific alarm mute rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "1ca987c6-e1de-4254-92b1-bb750b20aea6",
  "eventName": "GetAlarmMuteRule",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:45:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "afcaade8-e980-4279-84ce-97e3a8f0cf55",
  "requestParameters": {
    "alarmMuteRuleName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetDashboard

Service: monitoring

Description

Displays the details of the dashboard that you specify.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "errorCode": "DashboardNotFoundError",
  "errorMessage": "Dashboard CloudWatch-Default does not exist",
  "eventCategory": "Management",
  "eventID": "ada71d29-3e9e-456f-af5b-57b4d08bf39e",
  "eventName": "GetDashboard",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2021-07-07T13:08:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "797507667711",
  "requestID": "e00ab46c-90a9-4bca-a709-3025c9c4fc30",
  "requestParameters": null,
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "213.205.197.162",
  "userAgent": "AWS CloudWatch Console",
  "userIdentity": {
    "accessKeyId": "ASIA3TLZJI37TRWHLD2C",
    "accountId": "797507667711",
    "arn": "arn:aws:iam::797507667711:user/bruce",
    "principalId": "AIDA3TLZJI372XH6M2Q25",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T11:45:11Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bruce"
  }
}

References #

Sample log: cado-security/AWS_EKS_Cluster_Forensics

GetDataset

Service: monitoring

Description

Returns information about the specified dataset.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'datasetIdentifier' failed to satisfy constraint: Member must satisfy regular expression pattern: (default|arn:[a-zA-Z0-9-]+:cloudwatch:[a-zA-Z0-9-]*:\\d{12}:dataset/default)",
  "eventCategory": "Management",
  "eventID": "c5860bc1-c2a3-4a41-89dc-04ee949f7f79",
  "eventName": "GetDataset",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:45:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "bfd717cd-03c6-4fe1-a1ce-05cc3be7d80c",
  "requestParameters": {
    "datasetIdentifier": "ddddd"
  },
  "resources": [
    {
      "type": "AWS::CloudWatch::Dataset"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetInsightRuleReport

Service: monitoring

Description

This operation returns the time series data collected by a Contributor Insights rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterValueException",
  "errorMessage": "INVALID_PERIOD: A Period must be a multiple of 60 seconds, from 60 to 86400.",
  "eventCategory": "Management",
  "eventID": "0c265d71-a4d2-47ee-814f-4b0bc0420699",
  "eventName": "GetInsightRuleReport",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:45:11Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6472383b-2014-4093-907a-e9895de39a91",
  "requestParameters": {
    "endTime": "2020-01-01T00:00:00Z",
    "period": 1,
    "ruleName": "ddddd",
    "startTime": "2020-01-01T00:00:00Z"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetMetricData

Service: monitoring

Description

You can use the GetMetricData API to retrieve CloudWatch metric values.

GetMetricStatistics

Service: monitoring

Description

Gets statistics for the specified metric.

GetMetricStream

Service: monitoring

Description

Returns information about the metric stream that you specify.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "4b31e739-63b8-435a-87a1-d03c74df5e7e",
  "eventName": "GetMetricStream",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:45:11Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "48ffc006-b7e5-4263-bb28-706b67e8044f",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetMetricWidgetImage

Service: monitoring

Description

You can use the GetMetricWidgetImage API to retrieve a snapshot graph of one or more Amazon CloudWatch metrics as a bitmap image.

GetOTelEnrichment

Service: monitoring

Description

Returns the current status of vended metric enrichment for the account, including whether CloudWatch vended metrics are enriched with resource ARN and resource tag labels and queryable using PromQL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "98c978fa-9226-4801-9e2e-fdd6878a842f",
  "eventName": "GetOTelEnrichment",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:32:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3e4b0793-d702-4050-b0bf-0dfd1c7ba62e",
  "requestParameters": null,
  "resources": [
    {
      "type": "AWS::CloudWatch::OTelEnrichment"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAlarmMuteRules

Service: monitoring

Description

Lists alarm mute rules in your Amazon Web Services account and region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "397d0995-1024-4b4b-9e81-1b1bc82d26cb",
  "eventName": "ListAlarmMuteRules",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:32:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a753fa81-93d6-4e19-bedd-73ca51eef317",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDashboards

Service: monitoring

Description

Returns a list of the dashboards for your account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "ec9aeaa4-978c-4c36-9df5-37fdba13dbad",
  "eventName": "ListDashboards",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2021-07-07T18:21:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "797507667711",
  "requestID": "e5e7e012-2763-48ec-a8f1-a5edd5a30b89",
  "requestParameters": null,
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "213.205.197.162",
  "userAgent": "AWS CloudWatch Console",
  "userIdentity": {
    "accessKeyId": "ASIA3TLZJI37TTBU6EGN",
    "accountId": "797507667711",
    "arn": "arn:aws:iam::797507667711:user/bruce",
    "principalId": "AIDA3TLZJI372XH6M2Q25",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T11:45:11Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bruce"
  }
}

References #

Sample log: cado-security/AWS_EKS_Cluster_Forensics

ListManagedInsightRules

Service: monitoring

Description

Returns a list that contains the number of managed Contributor Insights rules in your account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterValueException",
  "errorMessage": "INVALID_RESOURCE_ARN: Invalid ARN.",
  "eventCategory": "Management",
  "eventID": "9c6c7a68-2461-4ee4-b833-f93db8b6681e",
  "eventName": "ListManagedInsightRules",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:45:11Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b85f9a0f-0c34-4b59-b98d-78c0b93abef2",
  "requestParameters": {
    "resourceARN": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListMetrics

Service: monitoring

Description

List the specified metrics.

ListMetricStreams

Service: monitoring

Description

Returns a list of metric streams in this account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "a1b2962a-6b77-47e0-91db-ca93b93b95ab",
  "eventName": "ListMetricStreams",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T18:32:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "8ea61ac8-691d-4e9f-aec7-a2e230a35d8e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListTagsForResource

Service: monitoring

Description

Displays the tags associated with a CloudWatch resource.

PutAlarmMuteRule

Service: monitoring

Description

Creates or updates an alarm mute rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "The Alarm Mute Rule Schedule expression provided is not valid",
  "eventCategory": "Management",
  "eventID": "6beab0b2-ec86-4d97-b427-ca4619f806d2",
  "eventName": "PutAlarmMuteRule",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "05e33ee9-e387-4ee4-bcd2-8d6e223a47a5",
  "requestParameters": {
    "creationId": "13b42226-3553-4bb0-ab86-d03fa6d34cc3/1782766749096",
    "description": "dwfix test mute rule",
    "muteTargets": {
      "alarmNames": [
        "dwfix-cw-metric-alarm"
      ]
    },
    "name": "dwfix-cw-mute-rule",
    "rule": {
      "schedule": {
        "duration": "PT1H",
        "expression": "cron(0 0 1 1 ? 2099)",
        "timezone": "UTC"
      }
    }
  },
  "resources": [
    {
      "ARN": "arn:aws:cloudwatch:us-west-1:123456789012:alarm-mute-rule:dwfix-cw-mute-rule",
      "accountId": "123456789012",
      "type": "AWS::CloudWatch::AlarmMuteRule"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutAnomalyDetector

Service: monitoring

Description

Creates an anomaly detection model for a CloudWatch metric.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9c9f45bc-90a3-4395-bde8-c623feda41da",
  "eventName": "PutAnomalyDetector",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "30d00e5d-1b53-474c-a519-03df31c20672",
  "requestParameters": {
    "singleMetricAnomalyDetector": {
      "metricName": "CPUUtilization",
      "namespace": "AWS/EC2",
      "stat": "Average"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutCompositeAlarm

Service: monitoring

Description

Creates or updates a composite alarm.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e53642fe-4747-46e9-ac04-bbc952254fe2",
  "eventName": "PutCompositeAlarm",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c5560185-224c-405d-b84f-0ad17f329dd7",
  "requestParameters": {
    "alarmDescription": "dwfix composite alarm",
    "alarmName": "dwfix-cw-composite-alarm",
    "alarmRule": "ALARM(\"dwfix-cw-metric-alarm\")"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutDashboard

Service: monitoring

Description

Creates a dashboard if it does not already exist, or updates an existing dashboard.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "61b67e7f-2b7b-4ca2-9fee-0bf23ac4c53d",
  "eventName": "PutDashboard",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "89633f13-1b1d-4285-ba39-dd96379e124d",
  "requestParameters": {
    "dashboardBody": {
      "widgets": [
        {
          "type": "metric",
          "x": 0,
          "y": 0,
          "width": 12,
          "height": 6,
          "properties": {
            "metrics": [
              [
                "AWS/EC2",
                "CPUUtilization"
              ]
            ],
            "period": 300,
            "stat": "Average",
            "region": "us-west-1",
            "title": "dwfix EC2 CPU"
          }
        }
      ]
    },
    "dashboardName": "dwfix-cw-dashboard"
  },
  "resources": [
    {
      "type": "AWS::CloudWatch::Metric"
    }
  ],
  "responseElements": {
    "dashboardValidationMessages": []
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutInsightRule

Service: monitoring

Description

Creates a Contributor Insights rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "6cf05326-0af9-4b20-91e7-1bc773eeca76",
  "eventName": "PutInsightRule",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "072472e5-c7d9-49d9-bda2-b37e90efd94d",
  "requestParameters": {
    "applyOnTransformedLogs": false,
    "ruleDefinition": {
      "Schema": {
        "Name": "CloudWatchLogRule",
        "Version": 1
      },
      "LogGroupNames": [
        "/aws/cloudtrail"
      ],
      "LogFormat": "JSON",
      "Contribution": {
        "Keys": [
          "$.userIdentity.arn"
        ],
        "Filters": []
      },
      "AggregateOn": "Count"
    },
    "ruleName": "dwfix-cw-insight-rule",
    "ruleState": "ENABLED"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutManagedInsightRules

Service: monitoring

Description

Creates a managed Contributor Insights rule for a specified Amazon Web Services resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3b7bf539-75c0-4d83-8388-4c0136e87bda",
  "eventName": "PutManagedInsightRules",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9f99278c-6a6c-4d17-93a2-df2d6e7ece3f",
  "requestParameters": {
    "managedRules": [
      {
        "resourceARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-cw-managed-table",
        "templateName": "DynamoDB-Operation-Per-Table"
      }
    ]
  },
  "responseElements": {
    "failures": [
      {
        "exceptionType": "ResourceNotFoundException",
        "failureCode": "TEMPLATE_NAME",
        "failureDescription": "Could not find template with the specified templateName.",
        "failureResource": "DynamoDB-Operation-Per-Table"
      }
    ]
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutMetricAlarm

Service: monitoring

Description

Creates or updates an alarm and associates it with the specified metric, metric math expression, anomaly detection model, Metrics Insights query, or PromQL query.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:PutMetricAlarm on resource: arn:aws:cloudwatch:us-west-2:811596193553:alarm:SecurityGroupConfigChangesAlarm",
  "eventID": "c5aa27bf-bd76-4ee9-9654-da598cb1860e",
  "eventName": "PutMetricAlarm",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2020-02-28T20:45:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "3b50e39f-4b46-48ac-a2d7-5d6195fdee9c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "250.0.35.1",
  "userAgent": "aws-cli/1.18.5 Python/3.7.0 Windows/10 botocore/1.15.5",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

PutMetricData

Service: monitoring

Description

Publishes metric data to Amazon CloudWatch.

PutMetricStream

Service: monitoring

Description

Creates or updates a metric stream.

SetAlarmState

Service: monitoring

Description

Temporarily sets the state of an alarm for testing purposes.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5a852976-b741-40f7-87c9-43659466d6fb",
  "eventName": "SetAlarmState",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9c2e0856-7ecd-4aa5-93f2-1c969ae42502",
  "requestParameters": {
    "alarmName": "dwfix-cw-metric-alarm",
    "stateReason": "dwfix test: manually setting alarm state",
    "stateValue": "ALARM"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartMetricStreams

Service: monitoring

Description

Starts the streaming of metrics for one or more of your metric streams.

StartOTelEnrichment

Service: monitoring

Description

Enables enrichment and PromQL access for CloudWatch vended metrics for supported Amazon Web Services resources in the account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "68611cfb-8f60-4bc4-a484-c5ed97639dd6",
  "eventName": "StartOTelEnrichment",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b385d922-df8a-4efb-8def-c95371b747d4",
  "requestParameters": null,
  "resources": [
    {
      "type": "AWS::CloudWatch::OTelEnrichment"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StopMetricStreams

Service: monitoring

Description

Stops the streaming of metrics for one or more of your metric streams.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f4acad5c-4a5b-4b1e-8009-08a9bc2c8c56",
  "eventName": "StopMetricStreams",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:24:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b96d4a94-4165-418f-8c5a-e4d7150b3c4a",
  "requestParameters": {
    "names": [
      "ddddd"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StopOTelEnrichment

Service: monitoring

Description

Disables enrichment and PromQL access for CloudWatch vended metrics for supported Amazon Web Services resources in the account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "1cada341-cb7d-4eae-8ab5-4bf116c7811c",
  "eventName": "StopOTelEnrichment",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T19:45:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cc106962-4e51-4f4d-9fcb-f1b42b6ff37d",
  "requestParameters": null,
  "resources": [
    {
      "type": "AWS::CloudWatch::OTelEnrichment"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: monitoring

Description

Assigns one or more tags (key-value pairs) to the specified CloudWatch resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "48c732e4-2074-4df4-8e7e-f72720623e1f",
  "eventName": "TagResource",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "77433ef9-5c82-407e-88d7-d33a44eefe39",
  "requestParameters": {
    "resourceARN": "arn:aws:cloudwatch:us-west-1:123456789012:alarm:dwfix-cw-metric-alarm",
    "tags": [
      {
        "key": "dwfix-tag",
        "value": "monitoring-recipe"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: monitoring

Description

Removes one or more tags from the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f3351771-47c0-4749-a8bc-dba4043b9e09",
  "eventName": "UntagResource",
  "eventSource": "monitoring.amazonaws.com",
  "eventTime": "2026-06-29T20:59:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0011c01d-aeea-45d7-9d08-611bfd156203",
  "requestParameters": {
    "resourceARN": "arn:aws:cloudwatch:us-west-1:123456789012:alarm:dwfix-cw-metric-alarm",
    "tagKeys": [
      "dwfix-tag"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetOTelEnrichmentConfiguration

Service: monitoring

Description

GetOTelEnrichmentConfiguration recorded by CloudTrail for Amazon CloudWatch. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "f86c90f8-55ec-4bad-8dcd-091d4d277373",
  "eventSource": "monitoring.amazonaws.com",
  "eventName": "GetOTelEnrichmentConfiguration",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "3eadf6ff-f9b4-48a5-8cab-51f65bbf24c5",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "monitoring.us-east-1.amazonaws.com"
  },
  "resources": [
    {
      "type": "AWS::CloudWatch::OTelEnrichmentConfiguration"
    }
  ]
}

PutLogAlarm

Service: monitoring

Description

Creates or updates a log alarm.

CloudWatch

any: CloudWatch (catch-all)

Description

DeleteAlarms

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

Splunk #

AssociateDatasetKmsKey

Description

DeleteAlarmMuteRule

Description

Example CloudTrail Event #

DeleteAnomalyDetector

Description

Example CloudTrail Event #

DeleteDashboards

Description

Example CloudTrail Event #

DeleteInsightRules

Description

Example CloudTrail Event #

DeleteMetricStream

Description

Example CloudTrail Event #

DescribeAlarmContributors

Description

Example CloudTrail Event #

DescribeAlarmHistory

Description

Example CloudTrail Event #

References #

DescribeAlarms

Description

Example CloudTrail Event #

References #

DescribeAlarmsForMetric

Description

Example CloudTrail Event #

References #

DescribeAnomalyDetectors

Description

Example CloudTrail Event #

References #

DescribeInsightRules

Description

Example CloudTrail Event #

References #

DisableAlarmActions

Description

Example CloudTrail Event #

DisableInsightRules

Description

Example CloudTrail Event #

DisassociateDatasetKmsKey

Description

Example CloudTrail Event #

EnableAlarmActions

Description

Example CloudTrail Event #

EnableInsightRules

Description

Example CloudTrail Event #

GetAlarmMuteRule

Description

Example CloudTrail Event #

GetDashboard

Description

Example CloudTrail Event #

References #

GetDataset

Description

Example CloudTrail Event #

GetInsightRuleReport

Description

Example CloudTrail Event #

GetMetricData

Description