AWS Cloud Trail Service Tables

Tables

AWSCloudTrailEvents

Name	Type	Description
AccessKeyID	string	The AWS access key ID that was used to sign the request. If the request was made with temporary security credentials, this is the access key ID of the temporary credentials.
AssumedRoleArn	string	The Amazon Resource Name (ARN) of the IAM role that was assumed during the event.
AssumedRoleID	string	The unique identifier for the assumed role session.
AuthenticationMethod	string	The method used to authenticate the request, such as `password`, `multi-factor authentication`, or `federated`.
AwsRegion	string	The AWS Region where the event occurred.
BatchDate	datetime	The date when the data was collected or processed.
BytesTransferredIn	integer	The number of bytes transferred into AWS services during the event.
BytesTransferredOut	integer	The number of bytes transferred out of AWS services during the event.
CipherSuite	string	The cipher suite used for the TLS connection between the client and AWS service.
CognitoIdpUsEast1AmazonawsComUsEast1Aaaaaaaaa	string	Likely represents a specific Cognito Identity Provider endpoint or configuration.
ConfigID	integer	An identifier for the specific configuration or data snapshot.
DurationSeconds	integer	The duration, in seconds, of the session. This is part of the sessionContext within userIdentity.
ErrorCode	string	The AWS service error code returned if the request failed.
ErrorMessage	string	A descriptive message explaining why the request failed, if applicable.
EventCategory	string	The category of the event. Valid values include `Management`, `Data`, `Insight`, `ConfigurationItem`, `Evidence`, and `ActivityAuditLog`.
EventDataStore	string	The identifier of the event data store where the event is recorded.
EventID	string	A unique identifier for the event.
EventName	string	The name of the API operation that was performed.
EventSource	string	The AWS service that the request was made to, such as `ec2.amazonaws.com`.
EventTime	datetime	The date and time when the event occurred.
EventType	string	The type of the event. Valid values include `AwsApiCall`, `AwsServiceEvent`, `AwsConsoleSignIn`, and others.
EventVersion	string	The version of the event record format.
ManagementEvent	bit	Indicates whether the event is a management event.
Message	string	A message associated with the event.
MessageAttributes	string	Attributes associated with the message in the event.
MessageStructure	string	The structure of the message in the event.
Name	string	A name associated with the event or resource.
Readonly	bit	Indicates whether the operation was read-only.
RecipientAccountID	string	The AWS account ID that received the request.
RequestID	string	The identifier for the request.
ResponseCredentialsAccessKeyId	string	The access key ID used in the response.
ResponseCredentialsExpiration	datetime	The expiration time of the credentials used in the response.
ResponseCredentialsSessionToken	string	The session token used in the response.
ResponseIdentityId	string	The identity ID in the response.
ResponseMessageId	string	The message ID in the response.
ResponseUserArn	string	The ARN of the user in the response.
ResponseUserName	string	The username in the response.
RoleArn	string	The ARN of the IAM role that was assumed during the event.
RoleSessionName	string	The name of the session when the IAM role was assumed.
SessionCredentialFromConsole	bit	This is an optional field available only for event data stores, which is used to filter management and data events based on whether the events originated from an AWS Management Console session.
SessionToken	string	The temporary security token provided by AWS STS when temporary security credentials are used.
SharedEventID	string	A GUID generated by CloudTrail to uniquely identify events from the same AWS action that are sent to different AWS accounts.
SignatureVersion	string	The version of the AWS Signature used to sign the request, such as `SigV4`.
SourceIPAddress	string	The IP address from which the request was made. For actions originating from the AWS Management Console, this is the IP address of the underlying customer resource, not the console web server.
Subject	string	The subject line of the message published to an Amazon SNS topic.
TlsCipherSuite	string	The cipher suite used for the TLS connection between the client and AWS service.
TlsClientProvidedHostHeader	string	The host header provided by the client during the TLS handshake.
TlsVersion	string	The version of the TLS protocol used for the connection, such as `TLSv1.2`.
TokenExpiration	datetime	The expiration time of the temporary security credentials.
TopicArn	string	The Amazon Resource Name (ARN) of the Amazon SNS topic to which a message was published.
UserAgent	string	The agent through which the request was made, such as `aws-cli/2.13.5 Python/3.11.4`.
UserIdentityAccessKeyID	string	The access key ID used to make the request.
UserIdentityAccountID	string	The AWS account ID associated with the identity that made the request.
UserIdentityArn	string	The Amazon Resource Name (ARN) of the identity that made the request.
UserIdentityPrincipalID	string	The unique identifier for the principal that made the request.
UserIdentitySessionContextCreationDate	datetime	The date and time when the session was created.
UserIdentitySessionContextMfaAuthenticated	bit	Indicates whether multi-factor authentication (MFA) was used for the session.
UserIdentitySessionContextSessionIssuerAccountID	string	The AWS account ID of the entity that issued the session.
UserIdentitySessionContextSessionIssuerArn	string	The ARN of the entity that issued the session.
UserIdentitySessionContextSessionIssuerPrincipalID	string	The principal ID of the entity that issued the session.
UserIdentitySessionContextSessionIssuerType	string	The type of the entity that issued the session, such as `Role` or `User`.
UserIdentitySessionContextSessionIssuerUserName	string	The username of the entity that issued the session.
UserIdentityType	string	The type of identity that made the request, such as `IAMUser`, `AssumedRole`, or `FederatedUser`.
UserIdentityUserName	string	The username of the identity that made the request.
UserName	string	A user name or role name of the requester that called the API in the event returned.
VpcEndpointAccountID	string	The AWS account ID of the owner of the VPC endpoint through which the request was made.
VpcEndpointID	string	This ﬁeld is only used to filter CloudTrail network activity events and is optional.

AWSEventInsightAttributionDetails

Name	Type	Description
Value	string	The specific attribute (e.g., user identity ARN, user agent, or error code) that contributed to the API calls or errors during the unusual activity period.
Average	float	The average number of API calls or errors per minute associated with the specified value during the unusual activity period. This metric helps identify which attributes had significant deviations from the baseline.
Type	string	The category of the attribute in the attributions block. Valid values include `userIdentityArn`, `userAgent`, or `errorCode`. This categorization helps in understanding the nature of the attribute contributing to the anomaly.
ID	integer	A unique identifier for the attribution entry. While not explicitly detailed in the standard AWS CloudTrail documentation, this field may be present in certain implementations to uniquely identify each attribution detail.
InsightAttributionID	integer	A unique identifier for the specific attribution within the Insights event. This ID helps in correlating attribution details across different parts of the Insights data.
InsightAttributionConfigID	integer	An identifier linking the attribution detail to a specific configuration or rule that generated the Insight. This helps in tracing back the attribution to its configuration source.
ConfigID	integer	An identifier for the configuration that was in effect during the time of the Insight. This can be useful for auditing and understanding the context in which the Insight was generated.
BatchDate	datetime	The date when the batch of events, including the Insight, was processed. This helps in tracking the processing timeline of events.

AWSEventInsightAttributions

Name	Type	Description
Attribute	string	The specific attribute (e.g., user identity ARN, user agent, or error code) that contributed to the API calls or errors during the unusual activity period.
ID	integer	A unique identifier for the attribution entry.
InsightDetailsID	integer	A unique identifier for the specific attribution within the Insights event. This ID helps in correlating attribution details across different parts of the Insights data.
InsightDetailsConfigID	integer	An identifier linking the attribution detail to a specific configuration or rule that generated the Insight. This helps in tracing back the attribution to its configuration source.
ConfigID	integer	An identifier for the configuration that was in effect during the time of the Insight. This can be useful for auditing and understanding the context in which the Insight was generated.
BatchDate	datetime	The date when the batch of events, including the Insight, was processed. This helps in tracking the processing timeline of events.

AWSEventInsights

Name	Type	Description
State	string	Indicates whether the event marks the beginning (Start) or end (End) of the unusual activity detected by CloudTrail Insights.
EventSource	string	The AWS service that was the source of the unusual activity, such as `ec2.amazonaws.com` or `s3.amazonaws.com`.
EventName	string	The name of the API operation that exhibited unusual behavior, such as StartInstances or DeleteBucket.
InsightType	string	The type of Insights event detected. Possible values are `ApiCallRateInsight` for unusual API call rates and `ApiErrorRateInsight` for unusual error rates.
AWSCloudTrailEventModelID	string	A unique identifier for the event model used by CloudTrail to represent the structure of the Insights event. This ID helps in correlating and analyzing events across different models.
ID	integer	A unique identifier for the specific Insights event record. This ID can be used to retrieve or reference the event in analyses.
ConfigID	integer	An identifier for the configuration that was in effect during the time of the Insights event. This can be useful for auditing and understanding the context in which the Insight was generated.
BatchDate	datetime	The date when the batch of events, including the Insight, was processed. This helps in tracking the processing timeline of events.

AWSEventInsightStatistics

Name	Type	Description
BaselineAverage	float	The average value of a specific metric (e.g., API call count or error rate) over a baseline period before the anomaly was detected.
InsightAverage	float	The average value of the same metric during the time period of the Insight (when the anomaly was active).
InsightDuration	integer	The length of time (in seconds or minutes) that the Insight event lasted.
BaselineDuration	integer	The length of the baseline period used to calculate the baseline average.
ID	integer	A unique identifier for the Event Insight Statistics record.
InsightDetailsID	integer	A reference ID linking the statistics record to the specific Insight event details it describes.
ConfigID	integer	The ID of the configuration set or system that collected or reported the statistics.
BatchDate	datetime	The date when the data for the Insight Statistics was batched or recorded, useful for tracking data freshness and update cycles.

AWSEventResources

Name	Type	Description
ARN	string	The Amazon Resource Name of the resource that was involved in the event. Uniquely identifies the resource across all AWS services.
Name	string	The name of the resource that was impacted or referenced in the CloudTrail event.
Type	string	The type of AWS resource (e.g., `AWS::EC2::Instance`, `AWS::S3::Bucket`) involved in the event.
AccountID	string	The AWS account ID that owns the resource.
ConfigID	integer	Identifier linking the resource to a specific configuration or data collection context.
BatchDate	datetime	The date on which the resource event data was collected or processed in batch.

Bridge Table

AWSCloudTrailEvents_AWSEventResources

Name	Type	Description
EventsEventID	string	The AWS account ID that owns the resource.
EventResourcesConfigID	integer	Identifier linking the resource to a specific configuration or data collection context.
EventsConfigID	integer	An identifier for the specific configuration or data snapshot.
EventResourcesARN	string	The Amazon Resource Name of the resource that was involved in the event. Uniquely identifies the resource across all AWS services.

Tables

AWSCloudTrailEvents

AWSEventInsightAttributionDetails

AWSEventInsightAttributions

AWSEventInsights

AWSEventInsightStatistics

AWSEventResources

Bridge Table

AWSCloudTrailEvents_AWSEventResources

Learn more...