log-aws-cloudtrail-*


CloudTrail - AWS Account(Bar)

Count

CloudTrail - AWS Account(Bar)


CloudTrail - Region(Bar)

CloudTrail - Region(Bar)

Count


CloudTrail - Source Countries

CloudTrail - Source Countries


CloudTrail - Source IP

CloudTrail - Source IP


CloudTrail - Source Countries(Geo)

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

CloudTrail - Source Countries(Geo)


CloudTrail - Source AS

CloudTrail - Source AS


CloudTrail - Login Failed

CloudTrail - Login Failed

Question: responseElements.ConsoleLogin:Failure


CloudTrail - Root Login(CIS3.3)

CloudTrail - Root Login(CIS3.3)

Question: userIdentity.type:Root AND NOT userIdentity.invokedBy:* AND NOT eventType:AwsServiceEvent


CloudTrail - Unauthorized API Calls(CIS3.1)

Question: errorCode:*UnauthorizedOperation OR errorCode:AccessDenied*


CloudTrail - UserIdentity.arn

CloudTrail - UserIdentity.arn


CloudTrail - Security Group Changed(CIS3.10)

Question: eventName:(AuthorizeSecurityGroupIngress OR AuthorizeSecurityGroupEgress OR RevokeSecurityGroupIngress OR RevokeSecurityGroupEgress OR CreateSecurityGroup OR DeleteSecurityGroup)


CloudTrail - NACL Changed(CIS3.11)

CloudTrail - NACL Changed(CIS3.11)

Question: eventName:(CreateNetworkAcl OR CreateNetworkAclEntry OR DeleteNetworkAcl OR DeleteNetworkAclEntry OR ReplaceNetworkAclEntry OR ReplaceNetworkAclAssociation)


CloudTrail - Network Gateway Changd(CIS3.12)

Question: eventName:(CreateCustomerGateway OR DeleteCustomerGateway OR AttachInternetGateway OR CreateInternetGateway OR DeleteInternetGateway OR DetachInternetGateway)


CloudTrail - Route Table Changd(CIS3.13)

Question: eventName:(CreateRoute OR CreateRouteTable OR ReplaceRoute OR ReplaceRouteTableAssociation OR DeleteRouteTable OR DeleteRoute OR DisassociateRouteTable)


CloudTrail - VPC Changed(CIS3.14)

CloudTrail - VPC Changed(CIS3.14)

Question: eventName:(CreateVpc OR DeleteVpc OR ModifyVpcAttribute OR AcceptVpcPeeringConnection OR CreateVpcPeeringConnection OR DeleteVpcPeeringConnection OR RejectVpcPeeringConnection OR AttachClassicLinkVpc OR DetachClassicLinkVpc OR DisableVpcClassicLink OR EnableVpcClassicLink)


CloudTrail - S3 Bucket Changed(CIS3.8)

CloudTrail - S3 Bucket Changed(CIS3.8)

Question: eventSource:s3.amazonaws.com AND (eventName:(PutBucketAcl OR PutBucketPolicy OR PutBucketCors OR PutBucketLifecycle OR PutBucketReplication OR DeleteBucketPolicy OR DeleteBucketCors OR DeleteBucketLifecycle OR DeleteBucketReplication))


CloudTrail - Event Name(Pie)

CloudTrail - Event Name(Pie)


CloudTrail - Event Name(Area)

CloudTrail - Event Name(Area)

Count


CloudTrail - Event Type(Pie)

CloudTrail - Event Type(Pie)


CloudTrail - Event Type(Area)

CloudTrail - Event Type(Area)

Count


CloudTrail - Error Code(Pie)

CloudTrail - Error Code(Pie)


CloudTrail - Error Code(Area)

CloudTrail - Error Code(Area)

Count


CloudTrail - Event Source(Pie)

CloudTrail - Event Source(Pie)


CloudTrail - Event Source(Area)

CloudTrail - Event Source(Area)

Count


search - CloudTrail


CloudTrail Summary