How To Enable Insight Events In AWS CloudTrail

How To Enable Insight Events In AWS CloudTrail

How To Enable Insight Events In AWS CloudTrail

Hello Everyone

Welcome to CloudAffaire and this is Debjeet.

In the last blog post, we have discussed how to create event selector for CloudTrail.

https://cloudaffaire.com/how-to-log-specific-events-in-cloudtrail-using-event-selector/

In today’s blog post, we will discuss how to enable insight events in AWS CloudTrail. CloudTrail Insights events capture unusual activity in your AWS account. If you have Insights events enabled, and CloudTrail detects unusual activity, Insights events are logged to a different folder or prefix in the destination S3 bucket for your trail. You can also see the type of insight and the incident time period when you view Insights events on the CloudTrail console.

Insights events provide relevant information, such as the associated API, incident time, and statistics, that help you understand and act on unusual activity. Unlike other types of events captured in a CloudTrail trail, Insights events are logged only when CloudTrail detects changes in your account’s API usage that differ significantly from the account’s typical usage patterns.

How To Enable Insight Events In AWS CloudTrail:

Prerequisites:

  • AWS CLI installed and configured with proper access. You can use below link to install and configure AWS CLI.

https://cloudaffaire.com/how-to-install-aws-cli/

https://cloudaffaire.com/how-to-configure-aws-cli/

Step 1: Create S3 bucket and bucket policy for CloudTrail logging.

Step 2: Create a new regional Trail

Step 3: Enable insight events for your Trail.

Note: AWS has only released ApiCallRateInsight insight event at this moment which detect change of rate in API call to your AWS landscape. Maybe in future AWS will release more insight types, please go through the official document for updates.

Note: It might take up to 36 hours to generate insights for your trail hence not able to show you the actual insight generated if any. If you perform lots of API action on that bucket all of a sudden a new insight will be generated.

Step 4: Clean up.

Hope you have enjoyed this article. To know more about AWS CloudTrail, please refer below official documentation

https://docs.aws.amazon.com/cloudtrail/index.html

Leave a Reply

Close Menu