CloudTrail

christophelimp christophe limpalair https://cybr.com

Management Events

Enabled by default

Management Events capture operations performed on resources in your AWS account. These are Control Plane operations, like: administrative API operations (creating, reading, updating, deleting, and listing resources).

Examples:
  • Configuring security (ie: AttachRolePolicy)
  • Registering devices (ie: CreateDefaultVpc)
  • Configuring rules for routing data (ie: CreateSubnet)
  • Setting up logging (ie: CreateTrail)

Management Events also include non-API events, like:

  • AWS service events - events created by AWS services but not directly triggered by a request you made to a public AWS API. Example: when a customer managed key is automatically rotated in AWS KMS
  • AWS Management Console Sign-In Events - examples include successfully or unsuccessfully signing in as an IAM user or as a root user, a root user changing their password or changing their MFA settings, etc...

Trails

Trails capture records of AWS activities and stores them in Amazon S3, which provides long-term storage (compared to Event History).

These records can be Management Events, Data Events, and Insights Events, depending on how you configure the trail(s)

Trails can also be configured to push logs to CloudWatch Logs Groups for further analysis and/or automated or manual action.

Data Events

Data Events provide visibility into the resource operations performed on or within a resource (Data Plane operations).

Examples:
  • Amazon DynamoDB - object-level API activity on tables like PutItem, DeleteItem, etc...
  • AWS Lambda - function execution activity via the Invoke API
  • Amazon S3 - object-level API activity like GetObject, PutObject, DeleteObject
  • AWS CloudTrail with PutAuditEvents
  • Etc...

Data Events are not enabled by default! This is very important to understand because it could leave you blind during certain incidents depending on your use case.

Event History

Enabled by default
  • Logs Management Events from an AWS Region
  • Gives viewable, searchable, and downloadable records of the past 90 days (but then you lose them)
  • Its records are immutable (can’t be modified once written)
  • Enabled at account creation for free

Insights

Insights Events help identify and respond to unusual activity associated with API calls and API error rates.

It constantly analyzes CloudTrail Management Events and can also analyze Data Events on trails, creating a baseline of normal patterns. It then generates Insights events whenever the call volume or error rates go outside of that normal pattern.

Insights Events provide relevant information for investigations:
  • The associated API
  • Error code
  • Incident time
  • Statistics

It only delivers events to S3 when unusual activity is detected

CreateUserNormal Baseline:<1 per week AccessDeniedExceptionDetected:15 per minute
Management Events
Insights
Event

CloudWatch Log Analytics

CloudWatch Logs centrally stores CloudTrail logs delivered by trails. CloudWatch Log Analytics is the default experience for analyzing those logs.

Use CloudWatch Log Analytics to query logs with CloudWatch Logs Insights, stream logs with Live Tail, and identify top contributors with Contributor Insights.

Log groups can enforce retention, encryption, and access controls, with subscriptions available for downstream processing.

Query across multiple event fields 
fields @timestamp,
  userIdentity.arn,
  awsRegion
| filter awsRegion in
  ["us-east-1", "us-west-2"]
| filter eventName = "ConsoleLogin"
| sort @timestamp desc
Visualize data with dashboards
Cybr

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Preview prompt
More cheat sheets