Enhancing AWS CloudTrail Lake with cutting-edge capabilities to revolutionize cloud transparency and accelerate forensic analysis

We are pleased to introduce innovative enhancements to our Managed Information Lake solution, designed to help organizations securely aggregate, store, and query data from various sources for audit, incident investigation, and operational issue resolution purposes.

CloudTrail Lake now offers the following groundbreaking enhancements:

• What if you could streamline your CloudTrail event analysis with more refined filtering options?
• What are the benefits of cross-account sharing of occasion information?
• The widespread accessibility of generative AI-fueled natural language processing has ushered in an unprecedented era of linguistic innovation?
• The AI-powered question outcomes summarization functionality in preview enables users to quickly and easily visualize complex data insights. By leveraging machine learning algorithms, this feature condenses large datasets into concise summaries, highlighting key findings and trends. This intuitive tool empowers users to make informed decisions with confidence, streamlining the analysis process and reducing the need for manual interpretation. With its seamless integration and user-friendly interface, the AI-powered question outcomes summarization functionality in preview is poised to revolutionize the way data is explored and understood.
• Deliver comprehensive dashboard capabilities, featuring a high-level overview dashboard that leverages AI-driven insights (currently in preview) alongside 14 pre-configured dashboards catering to various use cases, as well as the ability to craft tailored dashboards with automated refresh scheduling.

Let’s explore these brand-new options step by step.

CloudTrail’s enhanced occasion filtering capabilities enable users to exert greater control over the specific instances that are fed into their instance data repositories, thereby streamlining the ingestion process and optimizing data storage. These advanced filtering options provide more robust control over your AWS exercise data, thereby enhancing the efficacy and accuracy of security, compliance, and operational investigations? Furthermore, the introduction of cutting-edge filtering options enables organizations to streamline their evaluation workflows and reduce costs by processing only the most relevant event data directly into CloudTrail Lake event data repositories.

You will be able to filter each administrative event and information occasion primarily based on attributes such as eventSource, eventType, eventName, userIdentity.arn, and sessionCredentialFromConsole.

I am going to navigate to the main menu and select the required option from the drop-down list within the navigation panel. I select . Upon entering my desired level of reputation within the designated area, I utilize pre-set defaults across various disciplines. You’ll have the flexibility to choose pricing and retention options that align with your goals. As part of the subsequent step, I select below. You’ll be able to embody all of your choices below. You also have the option to make decisions about what to ingest. I immediately start processing newly generated content. In certain circumstances, users may desire to opt out of receiving event notifications by disabling the occasion information retailer’s ability to ingest events. In most cases, you will likely copy path instances directly to the event info repository without requiring the event info repository to collect any further events. You have the option to enable ingestions for all accounts within your group or restrict access to the current scope in your event data store.

The next instance features a comprehensive filtering template that selectively excludes administrative events triggered by AWS services, thereby streamlining your focus on relevant occurrences. I select  below the . I select something from the dropdown menu. Try it yourself and discover firsthand how the filters actually work.

The script establishes a DynamoDB filter to capture events triggered by a specific user, enabling me to track occurrences based on an IAM principal’s actions beneath that threshold. I select as . I select as . Beneath the , I select userIdentity.arn As I enter the individual’s ARNs. I carefully consider and then finalize my choice, making a decision that will ultimately determine the outcome of the process.

With my occasion information retailer, I have granular control over the CloudTrail data I ingest.

This enhanced suite of filtering options enables you to be even more discerning when identifying only the most relevant events that meet your precise security, compliance, and operational requirements.

Utilize occasion-based cross-account sharing in your organization’s information stores to foster seamless collaboration through shared insights. This feature enables secure sharing of occasion details with selected AWS principals through Resource-Based Policies (RBP). Entities authorized for a given performance are allowed to access and query shared data stores within the same AWS region where they were initially established. 

To utilize this feature, simply navigate to the desired location in your system and click on the respective option within the navigation panel. Upon selecting an occasion information retailer from the list, I navigate to its detailed webpage. What opportunities exist for me to explore and discover new possibilities in this moment? The instance coverage provides an assertion that grants root access to users with accounts 111111111111, 222222222222, and 333333333333, allowing them to execute queries and retrieve outcome data for the event information retailer associated with account ID 999999999999. I intend to save a significant amount of coverage.

We unveiled this feature for CloudTrail Lake in June. With the new launch, users can seamlessly generate SQL queries by asking natural-language questions to quickly discover and analyze AWS activity logs – limited to administrative, informational, and network events only – without requiring technical SQL expertise? The function leverages generative AI capabilities to convert natural language questions into executable SQL queries, allowing for seamless integration with the CloudTrail Lake console.

The process of investigating occasion data stores and extracting insights, such as error rates, top providers, and root cause analysis for errors, is streamlined. The function can also be accessed via a command-line interface, providing additional flexibility for users who prefer to work in this manner. Gaining access to the Pure Language Question Era functionality within CloudTrail Lake requires a series of steps, outlined below:

To unlock the full potential of the language-based question era, we’re launching an innovative AI-driven question summary feature, offering users a streamlined way to analyze and track their AWS account activities. This AI-powered tool enables seamless extraction of actionable insights from AWS exercise logs, specifically filtering administration, data, and network activity events, transforming complex results into concise summaries in natural language, thereby significantly reducing the time and effort spent on comprehending log data.

I’m going to navigate to the desired location by selecting the relevant option in the menu bar below within the navigation pane. I select an occasion information retailer for my CloudTrail Lake question from the dropdown list. Regardless of how a question is formulated, accurate summarization remains essential for effective communication. What are the core benefits of embracing artificial intelligence in business? Within the designated space, I enter the next immediate area utilizing pure language:

A thorough review of error logs from the past month reveals that a total of 357 issues were recorded across all services.

Then, I select . The SQL query process begins with a standardized framework that consistently produces questions.

SELECT eventsource,
    errorcode,
    errormessage,
    rely(*) as errorcount
FROM a0******
WHERE eventtime >= '2024-10-14 00:00:00'
    AND eventtime <= '2024-11-14 23:59:59'
    AND (
        errorcode IS NOT NULL
        OR errormessage IS NOT NULL
    )
GROUP BY 1,
    2,
    3
ORDER BY 4 DESC;

You choose to get the outcomes. To utilize the summarization feature, simply click within the tab. CloudTrail consistently scrutinizes the question outcomes, providing a concise linguistic summary of pivotal findings. The monthly data limit for summarizing question outcomes is set at three megabytes.

This new summarisation functionality can significantly reduce effort and time spent on understanding complex AWS exercise information by consistently generating concise summaries of key findings, thereby streamlining the learning process.

Here’s an updated version:

The primary feature provides a visual summary, offering an effortless glance at the data collected within your CloudTrail Lake administration, as well as event occurrences stored in event stores.

This intuitive dashboard streamlines insight discovery, enabling users to quickly grasp key findings, such as the most common API call failures, patterns in login attempts, and notable spikes in resource creation. The algorithm identifies irregularities or unusual patterns in the data.

I’m heading to the destination and selecting the required option from the navigation pane to explore the dashboard in detail. I enable Highlights dashboard by clicking.

As data becomes available, I promptly access the Highlights dashboard.

The second notable enhancement to our innovative dashboard capabilities is the introduction of a comprehensive suite of 14 carefully crafted, out-of-the-box dashboards. The dashboards cater to diverse user profiles and usage scenarios. The security-focused dashboards provide a clear visual representation of key safety metrics, including the tracing and analysis of critical indicators such as high-risk login attempts, failed console logins, and users who have disabled multi-factor authentication. Additionally, the platform features a range of pre-configured dashboards designed to facilitate operational monitoring, providing real-time insights into error patterns and availability metrics. You can also utilize dashboards specifically designed for various AWS providers, such as Amazon EC2, which provide real-time insights on potential security risks or operational issues within these specific service environments.

You’ll have the ability to craft unique, personalized dashboards and opt to schedule automatic updates at a time that suits you best. This level of customisation enables you to fine-tune the CloudTrail Lake evaluation features to precisely align with your monitoring and investigation requirements across all your AWS environments.

I take a look at the customized and pre-built dashboards?

I select a pre-built dashboard to review the overall performance of our IAM exercises in its entirety. You’ll have the ability to customize this dashboard.

To build a tailored dashboard from the ground up, I will navigate to the left-hand menu and choose. I establish a reputation within the confines of my own making. dashboard Here is the rewritten text in a professional style:

To visualize the various occasions, please select the relevant area information from the list below. Next, I will select…

Now you have the flexibility to customize your dashboard by adding various widgets. You possess the flexibility to customize your dashboards in various ways. You’ll have the ability to select from a curated library of pre-configured pattern widgets using our intuitive interface, or design your own bespoke widgets leveraging advanced customization options. For each widget, users have the flexibility to choose from various visualization options, such as line graphs, bar graphs, and more, allowing them to best represent their data.

The introduction of signifies a major breakthrough in providing comprehensive audit logging and evaluation solutions. By leveraging these advanced features, you can accelerate insight discovery and expedite investigation processes, thereby enabling more proactive surveillance and swift incident resolution across your entire AWS ecosystem.

Now you can begin leveraging generative AI models in CloudTrail Lake in the US East (Northern Virginia) region. The company’s global presence spans seven regions: Virginia in the United States, the US West in Oregon, Asia Pacific with offices in Mumbai, Sydney, and Tokyo, Canada’s Central region, and finally, Europe, anchored by its London hub.

CloudTrail Lake, a generative AI-powered feature that provides question outcomes, is now available in preview for users in the US East (N.) region. The company has established a strong presence in three key regions: the East Coast of the United States, the West Coast of the United States, specifically Oregon, and Tokyo in the Asia Pacific area.

The functionality of, as well as, can be discovered throughout all Areas, excluding the generative AI-powered summarization feature on the Highlights dashboard, which is only available in the US East (N.? Virginia), US West (Oregon), and Asia-Pacific (Tokyo) areas.

Operating queries on CloudTrail Lake may result in additional costs. To view detailed information regarding our pricing options, please visit our website at .