To hunt effectively in AWS CloudTrail, first establish what activity your logging setup could have captured, then examine each event’s identity, action, source, request and resource details, and surrounding timeline. An empty search is not proof that an action did not happen: the event may fall outside Event history’s scope, or the relevant event category may not have been collected.
What should I look for in CloudTrail?
Use each event as a lead to investigate, not as a verdict. CloudTrail records monitorable API and non-API account activity made through AWS interfaces and services. Its event types include management, data, network activity, and Insights events. A hunt should connect the actor and action to the source, target resource, request details, and related activity before and after the event.
Capture the fields that help explain an event
- When and where: event time, AWS Region, and the time zone used in your analysis. Normalize the hunt’s time range to UTC.
- What happened: event source or service and event name, which identify the API or activity recorded.
- Who or what acted: the identity context in the event. Distinguish root or IAM-user credentials, temporary credentials associated with roles or federated users, and service-generated activity. Attribute the action only as specifically as the recorded fields support.
- From what context: source IP and user agent when present. These can help compare an event with expected access, but should not be treated alone as proof of who controlled a credential.
- Against what, and how: resource identifiers, request parameters, response elements, and any error details. These help establish the target and the requested or returned information.
CloudTrail is intended to help identify which users and accounts called supported APIs, the source IP, and when calls occurred. The event fields provide investigative context; they do not necessarily establish a person’s intent or the full state of a resource.
How do I tell whether CloudTrail would have recorded this activity?
Check coverage before interpreting a missing event. CloudTrail Event history is automatically available, but it is not a permanent or complete record of every event type. Trails and CloudTrail Lake event data stores log management events by default; data, network activity, and Insights events are not included by default. Confirm that the relevant event category and selectors or configuration were enabled for the account, Region, and time in question.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match#1 Best Overall
- 2024 PCMag Editor's Choice - Praised for its outstanding value, delivering sharp 2K resolution and a comprehensive feature set.
- Compact, Versatile, Weatherproof - The Tapo C120 is a compact camera suitable for indoor and outdoor use, featuring an IP66 rating for withstanding rain, dust, and rugged conditions.
- Magnetic Base for Flexible Mounting - Easily attach the C120 camera to any metal surface with its magnetic base. Versatile mounting on railings, frames, or even the refrigerator.
- 2K QHD 4MP Resolution - Crystal-clear detail in every shot. Capture every moment with stunning 2K quality that ensures even the finest details are never missed.
- Starlight Color Night Vision - The built-in Starlight sensor delivers bright, colorful video at night, with two spotlights for extra illumination in darker conditions.
Make a coverage checklist
- Accounts: identify the account or organization in scope and whether the search covers one account or aggregated organization activity.
- Regions: identify the Region or Regions involved. Confirm whether a trail is multi-Region if activity could have occurred elsewhere.
- Time: record the exact UTC start and end times, plus the retention available from the source being queried.
- Event categories: establish whether management, data, network activity, or Insights events were enabled and delivered for the activity being investigated.
- Sources and stores: note the configured trails or event data stores and, if applicable, the Security Lake sources that were ingested.
For example, a management-event-only search cannot establish what happened inside S3 object operations or Lambda data activity if those data events were not enabled and ingested. Security Lake treats CloudTrail management events and S3 and Lambda data events as separate sources; confirm the applicable source configuration rather than assuming one covers the others.
When is Event history enough, and when should I use another source?
Event history is useful for quick triage of recent management activity. Its limits make it unsuitable as the only source for a longer, broader, or data-event-focused hunt. AWS states that Event history covers the previous 90 days of management events in one Region. It does not show data, Insights, or network activity events, and it does not aggregate organization activity. Its search is limited to one attribute filter plus a time-range filter.
Rank #2
- Ultra-compact, tamper-resistant, and weatherproof 2K HD PoE camera with long-range night vision.
- 2K (4MP) video resolution
- Ultra-wide viewing angle (102.4°)
- 30 m (98 ft) IR night vision
- AI event detections
| Option | Coverage and scope | Search and investigative use |
|---|---|---|
| CloudTrail Event history | Previous 90 days of management events in one Region; no data, Insights, or network activity events, or aggregated organization activity. | One attribute filter plus a time-range filter. Useful for recent, narrow triage. |
| Trail | Ongoing event delivery; AWS recommends a multi-Region trail to capture events across enabled Regions. Management events are logged by default; other event types require configuration. | Use trail-delivered records for a durable analysis workflow, with scope and retention determined by your setup. |
| CloudTrail Lake | Can query multiple Regions and, when configured, activity across an AWS Organizations organization. It can include more event types than Event history. | Supports queries across multiple attributes, making it suitable when Event history’s regional or search limits are too narrow. |
| Security Lake | Can ingest CloudTrail management events and S3 and Lambda data events as separate sources. | Consider it when those supported sources match the hunt; verify that the needed source was enabled and ingested. |
These are capability distinctions, not performance or cost comparisons. For an ongoing record, AWS recommends creating a trail. AWS’s CloudTrail documentation states: “For an ongoing record of events in your AWS account, create a trail or a CloudTrail Lake event data store.” See CloudTrail Event history documentation and the CloudTrail User Guide.
How do I build a useful timeline from CloudTrail events?
Start from a candidate event, then test a specific hypothesis—for example, whether an access change preceded an unexpected resource change. Group related activity by principal or session context, source, resource, Region, and time. Keep the relationship tentative until the event fields and relevant resource records support it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- SMART PERSON/VEHICLE/ANIMAL DETECTION: Say goodbye to unwanted alarms. With advanced person/vehicle/animal detection, the camera identifies genuine threats using cutting-edge algorithms, providing you with ultimate peace of mind. Animal detection is supported if your camera's firmware is updated to the latest version.
- EXCEPTIONAL 5MP SUPER HD: This PoE IP camera boasts 5MP videos at 25fps, capturing passing moments in ultra-sharp resolution without missing key details. With 18 specs IR lights and 3D-DNR technic, this camera is capable of delivering up to 100ft astounding night vision.
- MULTIPLE RECORDING OPTIONS: You can save 24/7 recordings or motion-detected videos to a 512GB microSD card (not included), FTP server, NAS, and Reolink PoE NVRs (Please note the hardware version) without an extra fee. Note that this PoE surveillance camera does not support third-party NVRs or camera systems.
- EASY REMOTE ACCESS WITH FREE APP/CLIENT: Enjoy live view, playback, and notifications via the free Reolink App and Client (iOS, Android, Windows, Mac) without any subscription. For first-time setup and activation, the camera must be connected to the same local network via a PoE switch/NVR using an Ethernet cable. For troubleshooting and setup assistance, contact Reolink's customer support for step-by-step guidance.
- TIMELAPSE TO SEE THE DAY IN A MINTUTE: This surveillance camera supports recording time-lapse videos. You can keep tracking of your 3D printing, see the whole construction process in a few minutes, or capture beautiful views from sunrise to sunset. It is easy to use and fun to share with friends. (Time lapse only works on Reolink App.)
- Record the candidate: preserve the event time, source, event name, identity context, Region, source IP, user agent if present, resource identifiers, request and response details, and errors.
- Pivot on context: search nearby activity associated with the same principal or session, source, resource, or Region. A single shared field is a lead, not proof that two events have the same operator or cause.
- Inspect changes that affect access or exposure: look for changes to permissions, logging, network exposure, and resource configuration. AWS guidance specifically recommends alerts for security-group and network-ACL changes; those alerts are monitoring controls, not evidence that every change is malicious.
- Check before and after: examine related events and the resulting resource state in the appropriate AWS records. Compare what the request asked for with what the service returned or what state followed.
- Test alternatives: account for expected administrative work, automation, and service-generated activity when the identity and event context support those possibilities.
How should I preserve and protect CloudTrail evidence?
For investigations, AWS recommends log-file integrity validation and centralized log analysis and response. Validated log files can help establish whether delivered files were changed or deleted; they do not establish that logging was complete before delivery. AWS also recommends centralized, dedicated S3 storage with strict access controls.
- Use a trail or event data store configured for the coverage the investigation needs, and document its retention boundaries.
- Protect the central log destination with appropriately restricted access.
- Preserve original records and the relevant query parameters used to find them.
- Document collection gaps, such as unconfigured data-event selectors, uncovered Regions, or periods outside available retention.
For AWS’s guidance on trail configuration and log protection, see CloudTrail security best practices. For recommendations on logging and monitoring controls, including security-group and network-ACL change alerts, see AWS Prescriptive Guidance on logging and monitoring. For Security Lake source coverage, see Security Lake sources.
Quick Recap
Best Value
- 16MP UHD & COLOR NIGHT VISION: Featuring two 4K image sensors, this dual-lens camera brings 16 UHD clarity to you, ensuring no small detail goes unnoticed. The F1.6 super aperture and 1/2.7'' CMOS sensor enable greater light intake, while 6x infrared LED lights unveil all night details up to 100ft.
- 180° PANORAMIC VIEW & MOTION TRACK: The dual-image stitching algorithms, coupled with 4-core SoC, create 180° panoramic views with less distortion & fewer blind spots. Thanks to the Motion Track feature that displays the complete movement of the target over time in one picture, you can save the hassle of viewing the entire video to find suspicious moments.
- SMART DETECTION & TWO-WAY TALK: Smartly detect person/car/animal movements from other objects, reducing false alarms. Upon motion detection, you’ll receive Push/email instantly and can talk with people by the cam side via 2-way talk directly through Reolink App/Client.
- PoE TECH & IP67 WEATHERPROOF: Only one cable handles both data transmission and stable power supply. (Note: The PoE NVR/switch/injector and DC power adapter are not included.) An easy setup for all-level users. Reolink Duo 3 PoE endures all weather conditions and facilitates ceiling or wall mounting. Ideal for versatile settings.
- SMART USER EXPERIENCE & TIME LAPSE: Enhance your surveillance efficiency with multiple smart features: remote live viewing, custom motion zones, and smart playback (up to 16x speed). Plus, time-lapse condenses long-term events into minutes, facilitating easy observation of transformations.
Rank #4
- SMART PERSON/VEHICLE/ANIMAL DETECTION: Say goodbye to unwanted alarms. With advanced person/vehicle/animal detection, the camera identifies genuine threats using cutting-edge algorithms, providing you with ultimate peace of mind. Animal detection is supported if your camera's firmware is updated to the latest version.
- Exceptional 5MP Super HD and Sound Recording: Boasting a high resolution of 2560x1920 at 25 fps, the RLC-520A security IP camera can capture crystal clear video with vivid details. With the built-in microphone, it also picks up ambient sound for an extra layer of security.
- Time-Lapse to See the Day in a Minute: This surveillance camera supports recording time-lapse videos. You can keep tracking of your 3D printing, see the whole construction process in a few minutes, or capture beautiful views from sunrise to sunset. It is easy to use and fun to share with friends. (Time lapse only works on Reolink App.)
- Faster and Simplified PoE Installation: Thanks to the power over Ethernet (PoE) technology, this outdoor camera can transmit videos and get power, signal, data via only one network cable, no WiFi worries. Simplified wiring means easier and cleaner installation. NOTE: Power supply is not included.
- Flexible Recording Options: The surveillance camera supports 24/7 continuous recording when movement is detected or during a scheduled time. Videos can be saved on a microSD card (up to 512GB, not included), Reolink NVR, or FTP server. Choose a way you prefer and enjoy customized security.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
