Viewing CloudTrail Insights events for trails
After you enable CloudTrail Insights on a trail, you can view up to 90 days of Insights events by using the CloudTrail
console or the Amazon CLI. This section describes how to view, look up, and download a file of
Insights events. For information about using the LookupEvents
API to retrieve
information from CloudTrail events, see the Amazon CloudTrail API Reference. For more information about CloudTrail Insights, see
Logging Insights events in this guide.
For information about how to create a trail, see Creating a trail with the CloudTrail console and Getting and viewing your CloudTrail log files.
Note
To log Insights events on API call volume, the trail must log write
management events.
To log Insights events on API error rate, the trail must log read
or write
management events.