Skip to main content

AWS CloudTrail

The CloudTrail Matano managed log source lets you ingest your AWS CloudTrail logs directly into Matano.

Usage

Use the managed log source by specifying the managed.type property in your log_source as AWS_CLOUDTRAIL.

name: "aws_cloudtrail"

managed:
type: "AWS_CLOUDTRAIL"

Then create tables for each of the Cloudtrail log types you want to ingest, under a tables/ subdirectory for your log source. For example, if you want to ingest Cloudtrail (default) and Cloudtrail Insights logs, create table files like so:

my-matano-dir/
└── log_sources/
└── cloudtrail/
└── log_source.yml
└── tables/
└── default.yml
└── insights.yml
└── ...
# log_sources/aws_cloudtrail/tables/default.yml
name: "default"

For a complete reference on configuring log sources, including extending the table schema, see Log source configuration.

Tables

The AWS CloudTrail managed log source supports the following tables:

  • default
    • A table is created for actual CloudTrail logs.
  • digest
    • CloudTrail digest files are transformed into a separate Matano table.
  • insights
    • CloudTrail insights logs are processed into a Matano table.

Matano automatically ingests data in your CloudTrail bucket into the corresponding table (e.g. cloudtrail_insights, cloudtrail).

Ingest

S3 (default)

For a log source named aws_cloudtrail, a file under the path /AWSLogs/249463413804/CloudTrail-Digest/us-east-1/2022/10/15/249463413804_CloudTrail-Digest_us-east-1_cheeseiad_us-east-1_20221015T195315Z.json.gz will be routed to the digest table.

Path scheme to table:

  • *Insights* -> insights
  • *Digest* -> digest
  • else -> default

Schema

CloudTrail data is normalized to ECS fields. Custom fields are normalized into the aws field. You can view the complete mapping to see the full schema.