{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/",
        "slug": "select-cloudtrail-data-events-explicitly-for-resource-access-investigations",
        "url": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/"
        },
        "title": "Select CloudTrail data events explicitly for resource-access investigations",
        "summary": "Management-event coverage does not automatically include object reads or function invocations.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:13:44+00:00",
        "modified_at": "2026-10-20T18:34:29+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 241,
        "potentially_affected": "This applies to selecting CloudTrail data-event coverage for supported resources and operations.",
        "dse_recommendation": "DSE recommends identifying the exact question the audit record must answer before choosing selectors.",
        "primary_source": {
            "name": "AWS Documentation",
            "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Management-event coverage does not automatically include object reads or function invocations.</p>\n<h2>Source facts</h2>\n<p>CloudTrail data events describe supported resource-level operations such as S3 object access and Lambda invocation. Trails and event data stores do not log data events by default, and additional charges apply. Advanced event selectors can narrow the event types and resources recorded for a particular investigation or monitoring need.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html\">AWS Documentation</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to selecting CloudTrail data-event coverage for supported resources and operations.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends identifying the exact question the audit record must answer before choosing selectors. Record which resource ARNs, read/write operations and exceptions are included. Estimate activity volume with the service owner and review current pricing before enabling broad collection. Keep the selection policy under change control so later reports can explain gaps. Assign retention, access and investigation ownership to the resulting data instead of enabling it without a plan for review. Make selector changes reviewable against a small table of required questions and representative API operations. Agree which excluded operations are intentional and who accepts that gap, then preserve the decision alongside the collection configuration for later incident interpretation.</p>\n<h2>Verification</h2>\n<p>Proposed verification: perform an approved disposable resource operation that should match the selector and one that should not. Inspect delivered events and confirm the actual resource and operation fields. Retain the selector configuration with the results and review collection volume before extending the scope.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html\">AWS Documentation</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Management-event coverage does not automatically include object reads or function invocations.\nSource facts\nCloudTrail data events describe supported resource-level operations such as S3 object access and Lambda invocation. Trails and event data stores do not log data events by default, and additional charges apply. Advanced event selectors can narrow the event types and resources recorded for a particular investigation or monitoring need.\nSource: AWS Documentation.\nApplicability\nThis applies to selecting CloudTrail data-event coverage for supported resources and operations.\nDSE recommendation\nDSE recommends identifying the exact question the audit record must answer before choosing selectors. Record which resource ARNs, read/write operations and exceptions are included. Estimate activity volume with the service owner and review current pricing before enabling broad collection. Keep the selection policy under change control so later reports can explain gaps. Assign retention, access and investigation ownership to the resulting data instead of enabling it without a plan for review. Make selector changes reviewable against a small table of required questions and representative API operations. Agree which excluded operations are intentional and who accepts that gap, then preserve the decision alongside the collection configuration for later incident interpretation.\nVerification\nProposed verification: perform an approved disposable resource operation that should match the selector and one that should not. Inspect delivered events and confirm the actual resource and operation fields. Retain the selector configuration with the results and review collection volume before extending the scope.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
        "content_markdown": "Management-event coverage does not automatically include object reads or function invocations.\n\n## Source facts\n\nCloudTrail data events describe supported resource-level operations such as S3 object access and Lambda invocation. Trails and event data stores do not log data events by default, and additional charges apply. Advanced event selectors can narrow the event types and resources recorded for a particular investigation or monitoring need.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html).\n\n## Applicability\n\nThis applies to selecting CloudTrail data-event coverage for supported resources and operations.\n\n## DSE recommendation\n\nDSE recommends identifying the exact question the audit record must answer before choosing selectors. Record which resource ARNs, read/write operations and exceptions are included. Estimate activity volume with the service owner and review current pricing before enabling broad collection. Keep the selection policy under change control so later reports can explain gaps. Assign retention, access and investigation ownership to the resulting data instead of enabling it without a plan for review. Make selector changes reviewable against a small table of required questions and representative API operations. Agree which excluded operations are intentional and who accepts that gap, then preserve the decision alongside the collection configuration for later incident interpretation.\n\n## Verification\n\nProposed verification: perform an approved disposable resource operation that should match the selector and one that should not. Inspect delivered events and confirm the actual resource and operation fields. Retain the selector configuration with the results and review collection volume before extending the scope.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/",
                "url": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Select CloudTrail data events explicitly for resource-access investigations",
                        "item": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/#article",
                "identifier": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/",
                "url": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/",
                "headline": "Select CloudTrail data events explicitly for resource-access investigations",
                "description": "Management-event coverage does not automatically include object reads or function invocations.",
                "abstract": "Management-event coverage does not automatically include object reads or function invocations.",
                "articleBody": "Management-event coverage does not automatically include object reads or function invocations.\nSource facts\nCloudTrail data events describe supported resource-level operations such as S3 object access and Lambda invocation. Trails and event data stores do not log data events by default, and additional charges apply. Advanced event selectors can narrow the event types and resources recorded for a particular investigation or monitoring need.\nSource: AWS Documentation.\nApplicability\nThis applies to selecting CloudTrail data-event coverage for supported resources and operations.\nDSE recommendation\nDSE recommends identifying the exact question the audit record must answer before choosing selectors. Record which resource ARNs, read/write operations and exceptions are included. Estimate activity volume with the service owner and review current pricing before enabling broad collection. Keep the selection policy under change control so later reports can explain gaps. Assign retention, access and investigation ownership to the resulting data instead of enabling it without a plan for review. Make selector changes reviewable against a small table of required questions and representative API operations. Agree which excluded operations are intentional and who accepts that gap, then preserve the decision alongside the collection configuration for later incident interpretation.\nVerification\nProposed verification: perform an approved disposable resource operation that should match the selector and one that should not. Inspect delivered events and confirm the actual resource and operation fields. Retain the selector configuration with the results and review collection volume before extending the scope.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:13:44+00:00",
                "dateModified": "2026-10-20T18:34:29+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/select-cloudtrail-data-events-explicitly-for-resource-access-investigations/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Select CloudTrail data events explicitly for resource-access investigations"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 241,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS Documentation",
                    "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"
                }
            }
        ]
    }
}