Viewing Insights events for trails
This section describes how you can lookup the last 90 days of Insights events for a trail with CloudTrail Insights enabled. For information about how to view CloudTrail Insights for an event data store, see Viewing the Insights dashboard for an event data store.
You can view, filter, and download the last 90 days of Insights events for a trail from the Insights page on the console.
You can lookup the last 90 days of Insights events programmatically by running the AWS CLI lookup-events command, or the LookupEvents API operation.
For descriptions of Insights events record fields for trails, see CloudTrail record contents for Insights events for trails.
Note
The Insights page and AWS CLI lookup-events command only list Insights events if you've enabled Insights on a trail that is logging management events. For information
about enabling Insights on a trail, see Enabling CloudTrail Insights on an existing
trail with the console and
Logging Insights events for a trail using
the AWS CLI.
To log Insights events on the API call rate, the trail must log write management events.
To log Insights events on the API error rate, the trail must log read or write management events.
Topics
