Trailblazer AWS

trailblazer awslogs enumerate

Enumerate CloudTrail logs with Trailblazer, detecting regions or events that are not logged (the logging bypass).

Run it when you need to verify that CloudTrail covers everything: Trailblazer (from ThreatResponse) enumerates CloudTrail logs by region and event type, and its queries detect the gaps — regions without a trail, unlogged events, disabled logging. It's the specific tool for the CloudTrail bypass: the attacker who disables the trail (or operates in an uncovered region) leaves the gap that Trailblazer finds. In IR and AWS logging audits, Trailblazer is the coverage check: the region without a trail and the unlogged event are the blind spots of detection.

Don't use it as a source of activity: Trailblazer enumerates logging coverage, not events (activity is queried directly in CloudTrail). The tool is AWS-specific and its development is old (the project is barely maintained): commands may need adaptation to the current API version. And note: CloudTrail coverage also depends on configuration (multi-region trail, log validation, deletion protection) — Trailblazer detects gaps, correct trail configuration prevents them. Periodic coverage verification is part of logging hardening: the unprotected trail and uncovered regions are the attacker's first targets.