AWS CloudTrail

Detection-relevant services

The 87 services below have deeper catalog coverage than a bare SDK stub. The remaining 273 SDK-enumerated services are listed separately below.

The CloudTrail event model

Each CloudTrail record carries a common envelope: eventSource (the service that received the call), eventName (the API action), eventType (the category, e.g. AwsApiCall or AwsConsoleSignIn), userIdentity (the calling IAM entity), sourceIPAddress, awsRegion, and action-specific requestParameters / responseElements. A detection keys on the (eventSource, eventName) pair to identify the action, then on the envelope and parameters to score it.

Management events and data events

CloudTrail distinguishes management events (control-plane operations such as CreateUser or AuthorizeSecurityGroupIngress, logged by default) from data events (high-volume data-plane operations such as S3 GetObject, Lambda Invoke, or KMS Decrypt, logged only when the trail is explicitly configured for them). The catalog includes high-value data events because detection rules cover them; their pages note that capturing them requires non-default trail configuration.

eventSource and eventName naming

The provider name derives from the actual CloudTrail eventSource, not the IAM prefix: CloudWatch logs under monitoring.amazonaws.com (provider AWS-monitoring), and all console sign-in events log under signin.amazonaws.com (provider AWS-signin) regardless of the target service. A handful of eventNames diverge from their IAM action name: s3:ListAllMyBuckets appears as eventName ListBuckets, and lambda:InvokeFunction appears as Invoke. The catalog stores the actual CloudTrail eventName.

References

• Event names: boto/botocore service models.
• Field names: awsdocs CloudTrail record contents.
• AWS: CloudTrail record contents reference
• AWS: Logging management and data events
• AWS Service Authorization Reference