AWS coverage

AWS API activity is recorded in CloudTrail, where every record carries an eventSource (the service endpoint that handled the call, such as iam.amazonaws.com) and an eventName (the specific API action, such as CreateUser). The (eventSource, eventName) pair is the unit a detection keys on, so this page groups the combined Sigma, Elastic, Sentinel, and Chronicle corpora by that pair. Each pair maps to a catalog entry under the AWS catalog.

Management events (control-plane API calls) are logged by default; data events (object-level operations such as S3 GetObject or Lambda Invoke) appear only when a trail is explicitly configured to capture them. Rules covering data events still attribute here, but their telemetry is not collected unless data-event logging is turned on. Rules that filter only on a wildcard eventName or only on eventSource cannot resolve to one pair and are grouped under (unattributed) or (any event).