---
title: "CloudTrail Events and Data Recording Cheat Sheet | Cybr"
description: "Management Events, Data Events, Insights Events, Event History, Trails, and CloudWatch Log Analytics."
url: https://cybr.com/cheat-sheets/cloudtrail-events-data-recording/
---

# CloudTrail

[christophelimp](https://x.com/christophelimp) [christophe limpalair](https://www.linkedin.com/in/christophelimpalair/) [https://cybr.com](https://cybr.com/)

## Management Events

Enabled by default

**Management Events capture operations performed on resources in your AWS account.** These are Control Plane operations, like: administrative API operations (creating, reading, updating, deleting, and listing resources).

**Examples:**

- Configuring security (ie: `AttachRolePolicy`)
- Registering devices (ie: `CreateDefaultVpc`)
- Configuring rules for routing data (ie: `CreateSubnet`)
- Setting up logging (ie: `CreateTrail`)

**Management Events also include non-API events, like:**

- **AWS service events** - events created by AWS services but not directly triggered by a request you made to a public AWS API. Example: when a customer managed key is automatically rotated in AWS KMS
- **AWS Management Console Sign-In Events** - examples include successfully or unsuccessfully signing in as an IAM user or as a root user, a root user changing their password or changing their MFA settings, etc...

## Trails

**Trails capture records of AWS activities and stores them in Amazon S3, which provides long-term storage** (compared to Event History).

**These records can be Management Events, Data Events, and Insights Events, depending on how you configure the trail(s)**

Trails can also be configured to push logs to CloudWatch Logs Groups for further analysis and/or automated or manual action.

## Data Events

**Data Events provide visibility into the resource operations performed on or within a resource (Data Plane operations).**

**Examples:**

- Amazon DynamoDB - object-level API activity on tables like `PutItem`, `DeleteItem`, etc...
- AWS Lambda - function execution activity via the `Invoke` API
- Amazon S3 - object-level API activity like `GetObject`, `PutObject`, `DeleteObject`
- AWS CloudTrail with `PutAuditEvents`
- Etc...

**Data Events are not enabled by default!** This is very important to understand because it could leave you blind during certain incidents depending on your use case.

## Event History

Enabled by default

- Logs Management Events from an AWS Region
- Gives viewable, searchable, and downloadable records of the past 90 days (but then you lose them)
- Its records are immutable (can’t be modified once written)
- Enabled at account creation for free

## Insights

**Insights Events help identify and respond to unusual activity associated with API calls and API error rates.**

It constantly analyzes CloudTrail Management Events and **can also analyze Data Events on trails**, creating a baseline of normal patterns. It then generates Insights events whenever the call volume or error rates go outside of that normal pattern.

Insights Events provide relevant information for investigations:

- The associated API
- Error code
- Incident time
- Statistics

It only delivers events to S3 when unusual activity is detected

`CreateUser`Normal Baseline:**<1 per week** `AccessDeniedException`Detected:**15 per minute**

 Management Events

**Insights
Event**

## CloudWatch Log Analytics

**CloudWatch Logs centrally stores CloudTrail logs delivered by trails. CloudWatch Log Analytics is the default experience for analyzing those logs.**

Use CloudWatch Log Analytics to query logs with CloudWatch Logs Insights, stream logs with Live Tail, and identify top contributors with Contributor Insights.

Log groups can enforce retention, encryption, and access controls, with subscriptions available for downstream processing.

Query across multiple event fields

```
fields @timestamp,
  userIdentity.arn,
  awsRegion
| filter awsRegion in
  ["us-east-1", "us-west-2"]
| filter eventName = "ConsoleLogin"
| sort @timestamp desc
```

Visualize data with dashboards

 [**Cybr**](https://cybr.com/)

## Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

[Learn how to use CloudTrail: **https://cybr.com/courses/beginners-guide-to-aws-cloudtrail-for-security/**](https://cybr.com/courses/beginners-guide-to-aws-cloudtrail-for-security/) [CloudTrail Documentation: **https://docs.aws.amazon.com/awscloudtrail/latest/userguide/
cloudtrail-user-guide.html**](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) [AWS cloud security community: **https://cybr.com/discord**](https://cybr.com/discord)

[More cheat sheets](https://cybr.com/cheat-sheets/)