AWS CloudTrail query

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin

Query AWS CloudTrail events with the CLI, looking for console logons and account activity.

Run it when you need AWS account activity: cloudtrail lookup-events queries the recorded events — ConsoleLogin, policy changes, API calls — with the user, IP, and result. Searching for ConsoleLogin answers 'who logged into the console and from where?': a service account logging into the console, access from an unusual IP, repeated failed logins. In AWS IR, CloudTrail is the source of truth for account activity: the attacker's event chain (login, policy change, key creation) is reconstructed with queries.

Don't use it as a complete source: CloudTrail records API calls in the account (by default in enabled regions) — activity outside CloudTrail (S3 data events, VPC flows) is in other sources; and coverage depends on the trail being configured and enabled in all regions (an attacker disabling the trail erases the source — Trailblazer, 168, detects it). The lookup-events CLI is limited in filtering (simple attributes and ranges): for complex queries (aggregations, correlations), use Athena on CloudTrail logs or the SIEM. And watch retention: lookup-events covers 90 days; long history lives in S3 (Athena). The result includes the event, not the full context — correlation with other sources is part of the analysis.