CloudTrail Lake: an insight row is not the list of calls

Insight is a summary CloudTrail wrote

CloudTrail can store management events, data events, and insight events in a store that was set up to keep them. An insight row means CloudTrail noticed a pattern, often a change in how often an API ran, and wrote a summary. eventCategory Insight is the field that says so. The row is not the set of underlying calls.

The names mentioned on the insight are the ones the summary chose to highlight. A complete list of calls is a query for management events in that window, with its own result count.

Cite the category before the story

If you mention an insight in a note, the first words include eventCategory Insight, the time range on that row, and the insight type string as printed. Then say you have not yet listed the calls, unless a second query did that and you cite its query id.

Do not paste the insight into a timeline as if each highlighted API were a single call at a single second. The summary is about a window.

What to file

File the insight’s event time, category, type string, and the window it describes. File the query id of any follow-up that listed management events, with that query’s result count. If you did not run the follow-up, write “calls not listed.” Do not fill the gap with the API names from the summary alone.

Worked case: a summary treated as fifteen calls

A sandbox store returns one row with eventCategory Insight. The summary text highlights ListBuckets and GetCallerIdentity over a two-hour window. A draft lists fifteen calls, one per sentence in the summary, and assigns each a made-up second.

The note quotes the category, the type string, and the two-hour window, and says “calls not listed.” A second query for management events in that window, with its own query id, returns nine rows. The finding cites nine management events and one insight. It does not cite fifteen.

eventCategory: Insight
window: two hours on the insight row
type: <string printed on the row>
follow-up: query id <id>
management events in that window: 9
write: one insight plus nine calls
not: fifteen calls read out of the summary