AWS CloudTrail telemetry sources

AWS records control-plane and data-plane activity in CloudTrail, which identifies each observable action by an (eventSource, eventName) pair rather than a numbered event log. The catalog models each eventSource (an AWS service endpoint such as iam.amazonaws.com) as a synthetic AWS-<service> provider, and each eventName (an API action such as CreateUser) as an event. These pages are kept separate from the Windows event catalog.

Services

The admitted services and eventNames are corpus-demand-gated: each entry is referenced by at least one ingested detection rule, plus a curated high-value data-event seed. See the cross-vendor AWS coverage matrix for which rules cover which API calls.

The CloudTrail event model

Each CloudTrail record carries a common envelope: eventSource (the service that received the call), eventName (the API action), eventType (the category, e.g. AwsApiCall or AwsConsoleSignIn), userIdentity (the calling IAM entity), sourceIPAddress, awsRegion, and action-specific requestParameters / responseElements. A detection keys on the (eventSource, eventName) pair to identify the action, then on the envelope and parameters to score it.

Source: AWS: CloudTrail record contents reference.

Management events and data events

CloudTrail distinguishes management events (control-plane operations such as CreateUser or AuthorizeSecurityGroupIngress, logged by default) from data events (high-volume data-plane operations such as S3 GetObject, Lambda Invoke, or KMS Decrypt, logged only when the trail is explicitly configured for them). The catalog includes high-value data events because detection rules cover them; their pages note that capturing them requires non-default trail configuration.

Source: AWS: logging management and data events.

eventSource and eventName naming

The provider name derives from the actual CloudTrail eventSource, not the IAM prefix: CloudWatch logs under monitoring.amazonaws.com (provider AWS-monitoring), and all console sign-in events log under signin.amazonaws.com (provider AWS-signin) regardless of the target service. A handful of eventNames diverge from their IAM action name: s3:ListAllMyBuckets appears as eventName ListBuckets, and lambda:InvokeFunction appears as Invoke. The catalog stores the actual CloudTrail eventName.

Source: AWS Service Authorization Reference.