AWS CloudTrail Investigation Guide: From Suspicious Alert to Full Scope in 60 Minutes

Before querying, confirm your logging baseline:

Check if a trail exists:

aws cloudtrail describe-trails --include-shadow-trails

Verify the trail is actively logging:

aws cloudtrail get-trail-status --name [trail-name]

Key fields to check in the output:

• IsLogging: true -- trail is active
• IsMultiRegionTrail: true -- required to catch cross-region activity; a single-region trail misses activity in other regions
• HasCustomEventSelectors or HasInsightSelectors -- confirms data events and/or Insights are enabled

If no trail exists and you need one immediately:

aws cloudtrail create-trail \
  --name incident-trail \
  --s3-bucket-name [your-bucket] \
  --is-multi-region-trail

aws cloudtrail start-logging --name incident-trail

Note: a new trail only captures events going forward. For historical events, you are limited to Event History (90 days) unless a prior trail was writing to S3.

Retrieve the full GuardDuty finding detail:

aws guardduty get-findings \
  --detector-id [id] \
  --finding-ids [finding-id] \
  | jq '.Findings[0]'

Extract the three primary pivot values from the finding:

1. Principal ARN (who acted):

jq '.Findings[0].Resource.AccessKeyDetails.UserName'
# or
jq '.Findings[0].Resource.AccessKeyDetails.PrincipalId'

1. Source IP (where it came from):

jq '.Findings[0].Service.Action.AwsApiCallAction.RemoteIpDetails.IpAddressV4'

1. The triggering API call (what they did):

jq '.Findings[0].Service.Action.AwsApiCallAction.Api'

These three values -- principal ARN, source IP, and triggering API call -- are the starting pivot points for everything that follows.

Quick lookup via CLI (90-day window, single attribute at a time):

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=[role-session-name] \
  --start-time 2026-05-13T00:00:00Z \
  --max-results 50 \
  | jq '.Events[] | {time: .EventTime, event: .EventName, region: (.CloudTrailEvent | fromjson | .awsRegion)}'

Full history via S3 trail with Athena (covers all time, all regions, all event types):

SELECT eventtime, eventsource, eventname, sourceipaddress,
       json_extract_scalar(useridentity, '$.arn') AS principal_arn,
       requestparameters
FROM cloudtrail_logs
WHERE year='2026' AND month='05'
  AND json_extract_scalar(useridentity, '$.sessionContext.sessionIssuer.arn') = '[role-arn]'
ORDER BY eventtime DESC
LIMIT 500;

The sessionContext.sessionIssuer.arn filter catches all assumed-role sessions from the compromised role, even if the session names differ across invocations.

Determine whether multiple principals were used from the same suspicious IP:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=SourceIPAddress,AttributeValue=[suspicious-ip] \
  | jq '.Events[] | {time: .EventTime, principal: (.CloudTrailEvent | fromjson | .userIdentity.arn), event: .EventName}'

Athena equivalent:

SELECT DISTINCT json_extract_scalar(useridentity, '$.arn') AS principal,
       COUNT(*) AS event_count
FROM cloudtrail_logs
WHERE sourceipaddress = '[suspicious-ip]'
  AND year='2026' AND month='05'
GROUP BY 1
ORDER BY 2 DESC;

If the suspicious IP is an internal address, cross-reference with VPC Flow Logs:

aws logs filter-log-events \
  --log-group-name [vpc-flow-log-group] \
  --filter-pattern "[version, account, eni, source=[suspicious-ip], ...]" \
  --start-time [epoch-ms]

Categorize the activity you find by attacker objective:

Credential persistence (attacker creating durable access):

• CreateAccessKey, CreateLoginProfile, UpdateLoginProfile

Privilege escalation:

• AttachUserPolicy, AttachRolePolicy, PutUserPolicy, CreateRole, PassRole

Reconnaissance:

• ListBuckets, ListFunctions, DescribeInstances, GetAccountSummary, ListRoles

Data exfiltration:

• GetObject (S3), GetSecretValue (Secrets Manager), GetParameter (SSM Parameter Store), Decrypt (KMS)

Covering tracks:

• DeleteTrail, StopLogging, DeleteLogGroup, DeleteFlowLogs

jq filter to isolate high-risk events from a downloaded CloudTrail export:

cat cloudtrail-export.json | jq '[
  .Records[] |
  select(.eventName | test(
    "CreateAccessKey|AttachUserPolicy|PutUserPolicy|CreateRole|GetSecretValue|DeleteTrail|StopLogging"
  ))
] | sort_by(.eventTime)'

Sort all events chronologically and extract the key fields:

cat cloudtrail-export.json | jq '[
  .Records[]
] | sort_by(.eventTime) | .[] | {
  time: .eventTime,
  action: .eventName,
  principal: .userIdentity.arn,
  region: .awsRegion,
  sourceIP: .sourceIPAddress,
  params: .requestParameters
}'

Analysis objectives for the timeline:

1. Initial access event: the first API call from the suspicious principal or IP. This is the breach point. Check what credential was used and whether there was a ConsoleLogin or AssumeRole event immediately before it.

2. Persistence mechanisms: any CreateAccessKey, CreateUser, or role modification after initial access. These indicate the attacker planned to return.

3. Blast radius: all resource types accessed, all regions where activity occurred, any data events (S3 GetObject at scale indicates exfiltration).

Timeline template columns for documentation and escalation:

| Timestamp (UTC) | EventName | Principal ARN | Source IP | Region | Resource Type | Resource ARN | Notes |