AWS CloudTrail telemetry sources
AWS records control-plane and data-plane activity in CloudTrail, which identifies each observable action by an The admitted services and eventNames are corpus-demand-gated: each entry is referenced by at least one ingested detection rule, plus a curated high-value data-event seed. See the cross-vendor AWS coverage matrix for which rules cover which API calls. Each CloudTrail record carries a common envelope: CloudTrail distinguishes management events (control-plane operations such as The provider name derives from the actual CloudTrail Source: AWS Service Authorization Reference.(eventSource, eventName) pair rather than a numbered event log. The catalog models each eventSource (an AWS service endpoint such as iam.amazonaws.com) as a synthetic AWS-<service> provider, and each eventName (an API action such as CreateUser) as an event. These pages are kept separate from the Windows event catalog.Services
The CloudTrail event model
eventSource (the service that received the call), eventName (the API action), eventType (the category, e.g. AwsApiCall or AwsConsoleSignIn), userIdentity (the calling IAM entity), sourceIPAddress, awsRegion, and action-specific requestParameters / responseElements. A detection keys on the (eventSource, eventName) pair to identify the action, then on the envelope and parameters to score it.Management events and data events
CreateUser or AuthorizeSecurityGroupIngress, logged by default) from data events (high-volume data-plane operations such as S3 GetObject, Lambda Invoke, or KMS Decrypt, logged only when the trail is explicitly configured for them). The catalog includes high-value data events because detection rules cover them; their pages note that capturing them requires non-default trail configuration.eventSource and eventName naming
eventSource, not the IAM prefix: CloudWatch logs under monitoring.amazonaws.com (provider AWS-monitoring), and all console sign-in events log under signin.amazonaws.com (provider AWS-signin) regardless of the target service. A handful of eventNames diverge from their IAM action name: s3:ListAllMyBuckets appears as eventName ListBuckets, and lambda:InvokeFunction appears as Invoke. The catalog stores the actual CloudTrail eventName.