Events
The Events page is an actor-centric explorer over your CloudTrail activity. Instead of a flat log, it organizes every event by the identity behind it — so you can see what an actor did, which resources they touched, and how their activity unfolds over time.
In the app: /events
Actor-Centric View
Activity is grouped by principal (IAM user, role or assumed-role session). For each actor you can see the events they generated, the resources those events touched, and summary counts — turning 'search the logs' into 'open the actor'.
Explorer & Filters
Narrow the event set two ways:
- Field filters — principal, event name, event source, resource, source IP, region, account, time range and more, with operators like eq, contains and in.
- Natural-language — describe what you want ("all console logins without MFA in the last day") and it generates the structured filter.
Timeline, Profile & Graph
Switch between views of the same activity: a timeline of events over a window, a per-actor profile summarizing behavior, and an activity graph linking actors to the resources they touched — useful for building an incident picture quickly.
From Investigation to Action
When you spot a compromised or misbehaving principal, containment is one step away — a matching automation rule can contain it automatically, or you can act from the Actions page. Investigations and automation share the same event data, so what you see here is exactly what rules evaluate.
Under the Hood
CloudTrail activity is streamed into S3 as NDJSON and compiled into columnar Parquet snapshots that a query engine reads — the same engine that powers Inventory. This keeps queries fast and storage cheap while retaining history for investigation.
Optional GuardDuty
If you run AWS GuardDuty, its findings can be routed in via EventBridge and drive the same automation rules. GuardDuty is optional — the events explorer works entirely from CloudTrail.
💡 Tip
Investigating an actor with unusual activity? Build a rule from what you see — for example, contain any principal that runs a sensitive API from an unexpected region — then watch it under Automation → Executions before adding a containment step.
ℹ️ Note
Events reflect CloudTrail activity forwarded to the application account after the stack is active. Inventory collection and event retention are independent — keep both configured for the accounts you care about.