Someone turned the trail off
A CloudTrail management log shows logging stopped for 37 minutes. Find who stopped it, how they signed in, what else they disabled, and what restarted it.
Briefing
Security automation restarted the organization trail at 03:41 after a CloudTrail StopLogging alarm. Events between stop and start are lost from that trail, but the calls around them survive.
Each record has userIdentity (who), sourceIPAddress (where from), and for console sign-ins additionalEventData.MFAUsed.
cloud-shell · Cloud logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.