{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/", "item": { "id": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/", "slug": "use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence", "url": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence.md", "json": "https://update.dsesecurity.com/api/v1/posts/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/" }, "title": "Use CloudTrail network activity events for supported VPC-endpoint API evidence", "summary": "Investigate endpoint-mediated API activity using the event category designed for it.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:45+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 243, "potentially_affected": "This applies to supported VPC endpoint services and CloudTrail network activity event selection.", "dse_recommendation": "DSE recommends identifying the endpoint owner, service and investigation goal before enabling collection.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Investigate endpoint-mediated API activity using the event category designed for it.

\n

Source facts

\n

CloudTrail network activity events let VPC endpoint owners record supported AWS API calls through their endpoints. AWS publishes the supported services and advanced event-selector fields. This category describes endpoint API activity rather than a packet capture or a general record of all IP flows through the VPC.

\n

Source: AWS Documentation.

\n

Applicability

\n

This applies to supported VPC endpoint services and CloudTrail network activity event selection.

\n

DSE recommendation

\n

DSE recommends identifying the endpoint owner, service and investigation goal before enabling collection. Check current support for the particular service and select the relevant endpoint and operation criteria. Coordinate with the security and network teams so endpoint-policy failures can be correlated with the application request. Keep packet-flow evidence separate where that is also needed. Document event retention, access and cost review before broadening selectors to additional endpoints or accounts. Start with one endpoint and a concrete API investigation question. Name the evidence owner for a request originating in another account, and require a separate explanation when the relevant service or operation is outside the supported collection scope.

\n

Verification

\n

Proposed verification: perform an authorized test API request through the selected endpoint and inspect its resulting event fields. Compare the selected service and endpoint with the current support reference. Record any unmatched case explicitly rather than interpreting the absence of this event type as proof that no network traffic occurred.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Investigate endpoint-mediated API activity using the event category designed for it.\nSource facts\nCloudTrail network activity events let VPC endpoint owners record supported AWS API calls through their endpoints. AWS publishes the supported services and advanced event-selector fields. This category describes endpoint API activity rather than a packet capture or a general record of all IP flows through the VPC.\nSource: AWS Documentation.\nApplicability\nThis applies to supported VPC endpoint services and CloudTrail network activity event selection.\nDSE recommendation\nDSE recommends identifying the endpoint owner, service and investigation goal before enabling collection. Check current support for the particular service and select the relevant endpoint and operation criteria. Coordinate with the security and network teams so endpoint-policy failures can be correlated with the application request. Keep packet-flow evidence separate where that is also needed. Document event retention, access and cost review before broadening selectors to additional endpoints or accounts. Start with one endpoint and a concrete API investigation question. Name the evidence owner for a request originating in another account, and require a separate explanation when the relevant service or operation is outside the supported collection scope.\nVerification\nProposed verification: perform an authorized test API request through the selected endpoint and inspect its resulting event fields. Compare the selected service and endpoint with the current support reference. Record any unmatched case explicitly rather than interpreting the absence of this event type as proof that no network traffic occurred.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Investigate endpoint-mediated API activity using the event category designed for it.\n\n## Source facts\n\nCloudTrail network activity events let VPC endpoint owners record supported AWS API calls through their endpoints. AWS publishes the supported services and advanced event-selector fields. This category describes endpoint API activity rather than a packet capture or a general record of all IP flows through the VPC.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html).\n\n## Applicability\n\nThis applies to supported VPC endpoint services and CloudTrail network activity event selection.\n\n## DSE recommendation\n\nDSE recommends identifying the endpoint owner, service and investigation goal before enabling collection. Check current support for the particular service and select the relevant endpoint and operation criteria. Coordinate with the security and network teams so endpoint-policy failures can be correlated with the application request. Keep packet-flow evidence separate where that is also needed. Document event retention, access and cost review before broadening selectors to additional endpoints or accounts. Start with one endpoint and a concrete API investigation question. Name the evidence owner for a request originating in another account, and require a separate explanation when the relevant service or operation is outside the supported collection scope.\n\n## Verification\n\nProposed verification: perform an authorized test API request through the selected endpoint and inspect its resulting event fields. Compare the selected service and endpoint with the current support reference. Record any unmatched case explicitly rather than interpreting the absence of this event type as proof that no network traffic occurred.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/", "url": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Use CloudTrail network activity events for supported VPC-endpoint API evidence", "item": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/#article", "identifier": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/", "url": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/", "headline": "Use CloudTrail network activity events for supported VPC-endpoint API evidence", "description": "Investigate endpoint-mediated API activity using the event category designed for it.", "abstract": "Investigate endpoint-mediated API activity using the event category designed for it.", "articleBody": "Investigate endpoint-mediated API activity using the event category designed for it.\nSource facts\nCloudTrail network activity events let VPC endpoint owners record supported AWS API calls through their endpoints. AWS publishes the supported services and advanced event-selector fields. This category describes endpoint API activity rather than a packet capture or a general record of all IP flows through the VPC.\nSource: AWS Documentation.\nApplicability\nThis applies to supported VPC endpoint services and CloudTrail network activity event selection.\nDSE recommendation\nDSE recommends identifying the endpoint owner, service and investigation goal before enabling collection. Check current support for the particular service and select the relevant endpoint and operation criteria. Coordinate with the security and network teams so endpoint-policy failures can be correlated with the application request. Keep packet-flow evidence separate where that is also needed. Document event retention, access and cost review before broadening selectors to additional endpoints or accounts. Start with one endpoint and a concrete API investigation question. Name the evidence owner for a request originating in another account, and require a separate explanation when the relevant service or operation is outside the supported collection scope.\nVerification\nProposed verification: perform an authorized test API request through the selected endpoint and inspect its resulting event fields. Compare the selected service and endpoint with the current support reference. Record any unmatched case explicitly rather than interpreting the absence of this event type as proof that no network traffic occurred.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:45+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use CloudTrail network activity events for supported VPC-endpoint API evidence" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 243, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html" } } ] } }