Check provider logo

CloudTrail trail has Insights enabled

cloudtrail_insights_exist

Severitylow
Servicecloudtrail
by Prowler
forensics-ready

CloudTrail trails that are logging are evaluated for Insights via insight selectors, which enable anomaly detection on management-event patterns (API call and error rates). The finding pinpoints logging trails where these selectors are missing.

Risk

Without Insights, abnormal API call or error rates can go unnoticed, delaying detection of credential abuse, privilege escalation, or runaway automation. Attackers may rapidly alter policies, delete resources, or exfiltrate data before response, impacting confidentiality and availability.

Run this check with Prowler CLI

prowler aws --checks cloudtrail_insights_exist

Run in Prowler Cloud

Recommendation

Enable CloudTrail Insights on all logging trails (ideally all-Region or organization trails). Activate both ApiCallRateInsight and ApiErrorRateInsight. Integrate alerts with monitoring and review anomalies regularly. Apply defense in depth and least privilege to reduce potential blast radius.

Remediation

CLI

aws cloudtrail put-insight-selectors --trail-name <TRAIL_NAME> --insight-selectors '[{"InsightType":"ApiCallRateInsight"}]'

Native IaC
Terraform
Other
  1. In the AWS Console, go to CloudTrail > Trails
  2. Select the trail that is logging
  3. Click Edit on the CloudTrail Insights section
  4. Enable Insights and select API call rate (or Error rate)
  5. Save changes

Source Code

Resource Type

AwsCloudTrailTrail

References