Skip to content

Instantly share code, notes, and snippets.

@huevos-y-bacon

huevos-y-bacon/cw_ct_log_insights_query.sql

Created August 4, 2023 10:29
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save huevos-y-bacon/7a994c029d1dac6718f754357b52d12b to your computer and use it in GitHub Desktop.
Save huevos-y-bacon/7a994c029d1dac6718f754357b52d12b to your computer and use it in GitHub Desktop.
Download ZIP
CloudWatch Log Insights Query - CloudTrail
Raw
cw_ct_log_insights_query.sql
# CloudTrail events: By Service / Role / principalId / etc
fields
eventTime
,eventName
,eventSource
,errorCode
,errorMessage
,userIdentity.principalId as principalId
,userIdentity.sessionContext.sessionIssuer.userName as SESSIONUSERID
,@message
# | filter SESSIONUSERID like /(?i)elev/
# | filter SESSIONUSERID not like /Dome9/
# | filter SESSIONUSERID not like /CloudHealth/
# | filter SESSIONUSERID not like /(?i)func/
# | filter eventSource not like /config/
# | filter eventSource not like /tagging/
# | filter eventSource not like /sts/
# | filter eventSource not like /lambda/
# | filter eventSource not like /glue/
# | filter requestParameters.logGroupName not like /(?i)lambda/
# | filter Role like /developer/
# | filter principalId not like /(?i)func/
# | filter @message like /(?i)firehose/
# | filter @message like /(?i)waf/
# | filter @message like /(?i)newrelic/
| filter errorCode like /^[a-zA-Z0-9].*$/
| filter awsRegion not like /us-east-1/
| sort eventTime desc
| limit 200
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment