AWS - CloudTrail

category: IT Services
provider: Amazon
commonfields:
  id: AWS - CloudTrail
  version: -1
configuration:
- display: AWS Default Region
  name: defaultRegion
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  required: false
- display: Role Arn
  name: roleArn
  type: 0
  required: false
- display: Role Session Name
  name: roleSessionName
  type: 0
  required: false
- display: Role Session Duration
  name: sessionDuration
  type: 0
  required: false
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  required: false
- display: Access Key
  name: access_key
  type: 0
  hidden: true
  required: false
- display: Secret Key
  name: secret_key
  type: 4
  hidden: true
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Amazon Web Services CloudTrail.
display: AWS - CloudTrail
name: AWS - CloudTrail
script:
  commands:
  - arguments:
    - description: Specifies the name of the trail.
      name: name
      required: true
    - description: Specifies the name of the Amazon S3 bucket designated for publishing log files.
      name: s3BucketName
      required: true
    - description: Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
      name: s3KeyPrefix
    - description: Specifies the name of the Amazon SNS topic defined for notification of log file delivery.
      name: snsTopicName
    - auto: PREDEFINED
      description: Specifies whether the trail is publishing events from global services such as IAM to the log files.
      name: includeGlobalServiceEvents
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Specifies whether the trail is created in the current region or in all regions. The default is false.
      name: isMultiRegionTrail
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Specifies whether log file integrity validation is enabled. The default is false.
      name: enableLogFileValidation
      predefined:
      - 'True'
      - 'False'
    - description: Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered. Not required unless you specify CloudWatchLogsRoleArn.
      name: cloudWatchLogsLogGroupArn
    - description: Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
      name: cloudWatchLogsRoleArn
    - description: Specifies the KMS key ID to use to encrypt the logs delivered by CloudTrail. The value can be an alias name prefixed by "alias/", a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
      name: kmsKeyId
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a trail that specifies the settings for delivery of log data to an Amazon S3 bucket. A maximum of five trails can exist in a region, irrespective of the region in which they were created.
    execution: true
    name: aws-cloudtrail-create-trail
    outputs:
    - contextPath: AWS.CloudTrail.Trails.Name
      description: Specifies the name of the trail.
      type: string
    - contextPath: AWS.CloudTrail.Trails.S3BucketName
      description: Specifies the name of the Amazon S3 bucket designated for publishing log files.
      type: string
    - contextPath: AWS.CloudTrail.Trails.IncludeGlobalServiceEvents
      description: Specifies whether the trail is publishing events from global services such as IAM to the log files.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.IsMultiRegionTrail
      description: Specifies whether the trail exists in one region or in all regions.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.TrailARN
      description: Specifies the ARN of the trail that was created.
      type: string
    - contextPath: AWS.CloudTrail.Trails.LogFileValidationEnabled
      description: Specifies whether log file integrity validation is enabled.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.SnsTopicARN
      description: Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered.
      type: string
    - contextPath: AWS.CloudTrail.Trails.S3KeyPrefix
      description: pecifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
      type: string
    - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsLogGroupArn
      description: Specifies the Amazon Resource Name (ARN) of the log group to which CloudTrail logs will be delivered.
      type: string
    - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsRoleArn
      description: Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
      type: string
    - contextPath: AWS.CloudTrail.Trails.KmsKeyId
      description: Specifies the KMS key ID that encrypts the logs delivered by CloudTrail.
      type: string
    - contextPath: AWS.CloudTrail.Trails.HomeRegion
      description: The region in which the trail was created.
      type: string
  - arguments:
    - description: 'Specifies the name or the CloudTrail ARN of the trail to be deleted. The format of a trail ARN is: arn:aws:cloudtrail:us-east-1:123456789012:trail/MyTrail.'
      name: name
      required: true
    description: Deletes a trail. This operation must be called from the region in which the trail was created. DeleteTrail cannot be called on the shadow trails (replicated trails in other regions) of a trail that is enabled in all regions.
    execution: true
    name: aws-cloudtrail-delete-trail
  - arguments:
    - description: Specifies a list of trail names, trail ARNs, or both, of the trails to describe. If an empty list is specified, information for the trail in the current region is returned.
      name: trailNameList
    - auto: PREDEFINED
      description: Specifies whether to include shadow trails in the response. A shadow trail is the replication in a region of a trail that was created in a different region. The default is true.
      name: includeShadowTrails
      predefined:
      - 'True'
      - 'False'
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves settings for the trail associated with the current region for your account.
    name: aws-cloudtrail-describe-trails
    outputs:
    - contextPath: AWS.CloudTrail.Trails.Name
      description: Name of the trail set by calling CreateTrail.
      type: string
    - contextPath: AWS.CloudTrail.Trails.S3BucketName
      description: Name of the Amazon S3 bucket into which CloudTrail delivers your trail files.
      type: string
    - contextPath: AWS.CloudTrail.Trails.S3KeyPrefix
      description: Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
      type: string
    - contextPath: AWS.CloudTrail.Trails.SnsTopicARN
      description: Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered.
      type: string
    - contextPath: AWS.CloudTrail.Trails.IncludeGlobalServiceEvents
      description: Set to True to include AWS API calls from AWS global services such as IAM. Otherwise, False.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.IsMultiRegionTrail
      description: Specifies whether the trail belongs only to one region or exists in all regions.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.HomeRegion
      description: The region in which the trail was created.
      type: string
    - contextPath: AWS.CloudTrail.Trails.TrailARN
      description: Specifies the ARN of the trail.
      type: string
    - contextPath: AWS.CloudTrail.Trails.LogFileValidationEnabled
      description: Specifies whether log file validation is enabled.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsLogGroupArn
      description: Specifies an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered.
      type: string
    - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsRoleArn
      description: Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
      type: string
    - contextPath: AWS.CloudTrail.KmsKeyId
      description: Specifies the KMS key ID that encrypts the logs delivered by CloudTrail.
      type: string
    - contextPath: AWS.CloudTrail.HasCustomEventSelectors
      description: Specifies if the trail has custom event selectors.
      type: boolean
  - arguments:
    - description: Specifies the name of the trail or trail ARN.
      name: name
      required: true
    - description: Specifies the name of the Amazon S3 bucket designated for publishing log files.
      name: s3BucketName
    - description: Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
      name: s3KeyPrefix
    - description: Specifies the name of the Amazon SNS topic defined for notification of log file delivery.
      name: snsTopicName
    - description: Specifies whether the trail is publishing events from global services such as IAM to the log files.
      name: includeGlobalServiceEvents
    - description: Specifies whether the trail applies only to the current region or to all regions. The default is false. If the trail exists only in the current region and this value is set to true, shadow trails (replications of the trail) will be created in the other regions. If the trail exists in all regions and this value is set to false, the trail will remain in the region where it was created, and its shadow trails in other regions will be deleted.
      name: isMultiRegionTrail
    - description: Specifies whether log file validation is enabled. The default is false.
      name: enableLogFileValidation
    - description: Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered. Not required unless you specify CloudWatchLogsRoleArn.
      name: cloudWatchLogsLogGroupArn
    - description: Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
      name: cloudWatchLogsRoleArn
    - description: Specifies the KMS key ID to use to encrypt the logs delivered by CloudTrail.
      name: kmsKeyId
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Updates the settings that specify delivery of log files. Changes to a trail do not require stopping the CloudTrail service.
    execution: true
    name: aws-cloudtrail-update-trail
    outputs:
    - contextPath: AWS.CloudTrail.Trails.Name
      description: Specifies the name of the trail.
      type: string
    - contextPath: AWS.CloudTrail.Trails.S3BucketName
      description: Specifies the name of the Amazon S3 bucket designated for publishing log files.
      type: string
    - contextPath: AWS.CloudTrail.Trails.IncludeGlobalServiceEvents
      description: Specifies whether the trail is publishing events from global services such as IAM to the log files.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.IsMultiRegionTrail
      description: Specifies whether the trail exists in one region or in all regions.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.TrailARN
      description: Specifies the ARN of the trail that was created.
      type: string
    - contextPath: AWS.CloudTrail.Trails.LogFileValidationEnabled
      description: Specifies whether log file integrity validation is enabled.
      type: boolean
    - contextPath: AWS.CloudTrail.Trails.SnsTopicARN
      description: Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered.
      type: string
    - contextPath: AWS.CloudTrail.Trails.S3KeyPrefix
      description: pecifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
      type: string
    - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsLogGroupArn
      description: Specifies the Amazon Resource Name (ARN) of the log group to which CloudTrail logs will be delivered.
      type: string
    - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsRoleArn
      description: Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
      type: string
    - contextPath: AWS.CloudTrail.Trails.KmsKeyId
      description: Specifies the KMS key ID that encrypts the logs delivered by CloudTrail.
      type: string
    - contextPath: AWS.CloudTrail.Trails.HomeRegion
      description: The region in which the trail was created.
      type: string
  - arguments:
    - description: Specifies the name or the CloudTrail ARN of the trail for which CloudTrail logs AWS API calls.
      name: name
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Starts the recording of AWS API calls and log file delivery for a trail. For a trail that is enabled in all regions, this operation must be called from the region in which the trail was created. This operation cannot be called on the shadow trails (replicated trails in other regions) of a trail that is enabled in all regions.
    execution: true
    name: aws-cloudtrail-start-logging
  - arguments:
    - description: Specifies the name or the CloudTrail ARN of the trail for which CloudTrail logs AWS API calls.
      name: name
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Suspends the recording of AWS API calls and log file delivery for the specified trail. Under most circumstances, there is no need to use this action. You can update a trail without stopping it first. This action is the only way to stop recording. For a trail enabled in all regions, this operation must be called from the region in which the trail was created, or an InvalidHomeRegionException will occur. This operation cannot be called on the shadow trails (replicated trails in other regions) of a trail enabled in all regions.
    execution: true
    name: aws-cloudtrail-stop-logging
  - arguments:
    - auto: PREDEFINED
      description: Specifies an attribute on which to filter the events returned.
      name: attributeKey
      predefined:
      - AccessKeyId
      - EventId
      - EventName
      - Username
      - ResourceType
      - ResourceName
      - EventSource
      - ReadOnly
      required: true
    - description: Specifies a value for the specified AttributeKey.
      name: attributeValue
      required: true
    - description: Specifies that only events that occur after or at the specified time are returned.
      name: startTime
    - description: Specifies that only events that occur before or at the specified time are returned.
      name: endTime
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Looks up API activity events captured by CloudTrail that create, update, or delete resources in your account. Events for a region can be looked up for the times in which you had CloudTrail turned on in that region during the last seven days.
    name: aws-cloudtrail-lookup-events
    outputs:
    - contextPath: AWS.CloudTrail.Events.EventId
      description: The CloudTrail ID of the event returned.
      type: string
    - contextPath: AWS.CloudTrail.Events.EventName
      description: The name of the event returned.
      type: string
    - contextPath: AWS.CloudTrail.Events.EventTime
      description: The date and time of the event returned.
      type: date
    - contextPath: AWS.CloudTrail.Events.EventSource
      description: The AWS service that the request was made to.
      type: string
    - contextPath: AWS.CloudTrail.Events.Username
      description: A user name or role name of the requester that called the API in the event returned.
      type: string
    - contextPath: AWS.CloudTrail.Events.ResourceName
      description: 'The type of a resource referenced by the event returned. When the resource type cannot be determined, null is returned. Some examples of resource types are: Instance for EC2, Trail for CloudTrail, DBInstance for RDS, and AccessKey for IAM. '
      type: string
    - contextPath: AWS.CloudTrail.Events.ResourceType
      description: The name of the resource referenced by the event returned. These are user-created names whose values will depend on the environment. For example, the resource name might be "auto-scaling-test-group" for an Auto Scaling Group or "i-1234567" for an EC2 Instance.
      type: string
    - contextPath: AWS.CloudTrail.Events.CloudTrailEvent
      description: A JSON string that contains a representation of the event returned.
      type: string
  - arguments:
    - description: Specifies the names of multiple trails.
      name: trailNameList
    - description: Specifies the region of the trail.
      name: region
      required: true
    - description: The The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - description: Specifies the name of the trail.
      name: name
      required: true
    description: Returns a JSON-formatted list of information about the specified trail. Fields include information on delivery errors, Amazon SNS and Amazon S3 errors, and start and stop logging times for each trail.
    name: aws-cloudtrail-get-trail-status
    outputs:
    - contextPath: AWS.CloudTrail.TrailStatus.IsLogging
      description: Whether the CloudTrail trail is currently logging Amazon Web Services API calls.
      type: boolean
    - contextPath: AWS.CloudTrail.TrailStatus.LatestDeliveryError
      description: Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver log files to the designated bucket.
      type: string
    - contextPath: AWS.CloudTrail.TrailStatus.LatestNotificationError
      description: Displays any Amazon SNS error that CloudTrail encountered when attempting to send a notification.
      type: string
    - contextPath: AWS.CloudTrail.TrailStatus.LatestDeliveryTime
      description: Specifies the date and time that CloudTrail last delivered log files to an account’s Amazon S3 bucket.
      type: date
    - contextPath: AWS.CloudTrail.TrailStatus.LatestNotificationTime
      description: Specifies the date and time of the most recent Amazon SNS notification that CloudTrail has written a new log file to an account’s Amazon S3 bucket.
      type: date
    - contextPath: AWS.CloudTrail.TrailStatus.StartLoggingTime
      description: Specifies the most recent date and time when CloudTrail started recording API calls for an Amazon Web Services account.
      type: date
    - contextPath: AWS.CloudTrail.TrailStatus.StopLoggingTime
      description: Specifies the most recent date and time when CloudTrail stopped recording API calls for an Amazon Web Services account.
      type: date
    - contextPath: AWS.CloudTrail.TrailStatus.LatestCloudWatchLogsDeliveryError
      description: Displays any CloudWatch Logs error that CloudTrail encountered when attempting to deliver logs to CloudWatch Logs.
      type: string
    - contextPath: AWS.CloudTrail.TrailStatus.LatestCloudWatchLogsDeliveryTime
      description: Displays the most recent date and time when CloudTrail delivered logs to CloudWatch Logs.
      type: date
    - contextPath: AWS.CloudTrail.TrailStatus.LatestDigestDeliveryTime
      description: Specifies the date and time that CloudTrail last delivered a digest file to an account’s Amazon S3 bucket.
      type: date
    - contextPath: AWS.CloudTrail.TrailStatus.LatestDigestDeliveryError
      description: Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver a digest file to the designated bucket.
      type: string
  dockerimage: demisto/boto3py3:1.0.0.10221838
  runonce: false
  script: ''
  subtype: python3
  type: python
tests:
- No Tests
fromversion: 5.0.0