Viewing Insights events for trails
This section describes how you can lookup the last 90 days of Insights events for a trail with CloudTrail Insights enabled. For information about how to view CloudTrail Insights for an event data store, see Viewing the Insights dashboard for an event data store.
You can view, filter, and download the last 90 days of Insights events for a trail from the Insights page on the console.
You can fetch the last 90 days of Insights events programmatically:
-
For Trails logging management events by running the Amazon CLI lookup-events command, or the LookupEvents API operation.
-
For Trails logging data events by running the Amazon CLI list-insights-data command, or the ListInsightsData API operation.
For descriptions of Insights events record fields for trails, see CloudTrail record contents for Insights events for trails.
Note
The Insights page and Amazon CLI lookup-events or list-insights-data command only list Insights events if you've enabled Insights on a trail that is logging management or data events. For information
about enabling Insights on a trail, see Enabling CloudTrail Insights on an existing
trail with the console and
Logging Insights events for a trail using
the Amazon CLI.
To log Insights events on the API call rate, the trail must log write management or data events.
To log Insights events on the API error rate, the trail must log read or write management or data events.