Skip to content
Sign In
Telemetry

aws:cloudtrail

AWS CloudTrail

Event keys are CloudTrail eventName values

Host type
AWS
Tier, as a whole
Minimum
Cost class
Included
Techniques
90
Rules listed
463
Events
404

Why this tier

CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A10 (Attack vectors and lateral movement; our analysis); OMB M-26-14 A4 (Privilege changes; our analysis); OMB M-26-14 A5 (Infrastructure changes; our analysis); OMB M-26-14 A8 (Anomalous activity; our analysis)

Licensing

License or service
CloudTrail
What is free
One copy to S3 free; 90-day Event history free
What costs
Additional copies ~$2/100k events; S3 storage
Notes
Page updated 2026-10-26
Vendor page
https://aws.amazon.com/cloudtrail/pricing/
As read on
2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Standards and guidance naming this source

RequirementRelationBasis
OMB M-26-14: Identity usedSupports an activityour analysis: userIdentity on every record
OMB M-26-14: Privilege changesSupports an activityour analysis: IAM policy and role operations
OMB M-26-14: Infrastructure changesSupports an activityour analysis: RunInstances TerminateInstances and configuration changes
OMB M-26-14: Anomalous activitySupports an activityour analysis: unusual API usage
OMB M-26-14: Attack vectors and lateral movementSupports an activityour analysis: AssumeRole chains and ConsoleLogin
ASD ACSC / CISA et al.: Priority enterprise log sourcespriority_sourcequoted (cloud): use of the tenant's user accounts; administrative configuration changes; security principals; logs for cloud APIs

Techniques

Rules

Splunk 113
Sigma 58
Elastic 217
Microsoft Sentinel 75

Events

Recommended (87)

Listed (296)

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.