# Use CloudTrail network activity events for supported VPC-endpoint API evidence

> Investigate endpoint-mediated API activity using the event category designed for it.

- Canonical URL: https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:13:45+00:00
- Modified: 2026-10-20T18:34:29+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Investigate endpoint-mediated API activity using the event category designed for it.

## Potentially affected

This applies to supported VPC endpoint services and CloudTrail network activity event selection.

## DSE recommendation

DSE recommends identifying the endpoint owner, service and investigation goal before enabling collection.

## Article

Investigate endpoint-mediated API activity using the event category designed for it.

## Source facts

CloudTrail network activity events let VPC endpoint owners record supported AWS API calls through their endpoints. AWS publishes the supported services and advanced event-selector fields. This category describes endpoint API activity rather than a packet capture or a general record of all IP flows through the VPC.

Source: [AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html).

## Applicability

This applies to supported VPC endpoint services and CloudTrail network activity event selection.

## DSE recommendation

DSE recommends identifying the endpoint owner, service and investigation goal before enabling collection. Check current support for the particular service and select the relevant endpoint and operation criteria. Coordinate with the security and network teams so endpoint-policy failures can be correlated with the application request. Keep packet-flow evidence separate where that is also needed. Document event retention, access and cost review before broadening selectors to additional endpoints or accounts. Start with one endpoint and a concrete API investigation question. Name the evidence owner for a request originating in another account, and require a separate explanation when the relevant service or operation is outside the supported collection scope.

## Verification

Proposed verification: perform an authorized test API request through the selected endpoint and inspect its resulting event fields. Compare the selected service and endpoint with the current support reference. Record any unmatched case explicitly rather than interpreting the absence of this event type as proof that no network traffic occurred.

## Official reference

[AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS Documentation
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use CloudTrail network activity events for supported VPC-endpoint API evidence,” DSE Security, https://update.dsesecurity.com/updates/use-cloudtrail-network-activity-events-for-supported-vpc-endpoint-api-evidence/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.