Queries for the AWSCloudTrail table
New users per region
Returns count of created users per region.
AWSCloudTrail
| where EventName == "CreateUser"
| summarize count() by AWSRegion
All AWS CloudTrail events
Lists all AWS cloud trail events.
AWSCloudTrail
| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent, UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements, SessionIssuerUserName
AWSCT for user
AWS activity for a user.
// Set v_sessionissuerusername and v_userpid with the details of the user of interest
let v_sessionissuerusername ="abc";let v_userpid ="AIDxXxXxXxXxXxX";
AWSCloudTrail
| where SessionIssuerUserName == v_sessionissuerusername or UserIdentityPrincipalid ==v_userpid
| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent, UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements, SessionIssuerUserName
AWS console sign in
Lists AWS signin events.
AWSCloudTrail
| where EventName =~ "ConsoleLogin"
| extend MFAUsed = tostring(parse_json(AdditionalEventData).MFAUsed), LoginResult = tostring(parse_json(ResponseElements).ConsoleLogin)
| summarize Count=count() by UserIdentityAccountId, UserIdentityUserName, MFAUsed, LoginResult
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for