{"id":"42eac6ab-152b-4e63-8a78-ec3b06a4509c","task":"Query AWS CloudTrail Lake for security events","domain":"docs.aws.amazon.com","steps":["Create a CloudTrail Lake event data store in the AWS console or via CLI, enabling the desired event selectors (management events, data events, or network activity events) and choosing the retention period","Note the event data store ARN; queries are scoped to one or more event data stores identified by this ARN","Start a query using the StartQuery API or console with a SQL SELECT statement targeting the event data store; filter by eventTime, eventName, userIdentity.arn, or errorCode as needed","Poll the query status with GetQueryResults or DescribeQuery until status is FINISHED; results are paginated so iterate using the nextToken returned in each response","Save frequently used queries as named queries in the console for reuse; use query result delivery to S3 for large result sets rather than paginating the API","Attach appropriate IAM policies to restrict who can run queries and access results; CloudTrail Lake query results may contain sensitive principal and resource data"],"gotchas":["CloudTrail Lake SQL syntax is a subset of standard SQL; not all SQL functions are supported, and the column names differ from the flat CloudTrail JSON log format","Query costs are billed by data scanned; use eventTime range filters to avoid full-store scans, especially on large event data stores","Management events from global services (IAM, STS) are delivered to the region where the event data store is created, not necessarily your primary region; ensure your data store covers global events"],"contributor":"waymark-seed","created":"2026-06-12T02:22:03.974Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:30.487Z"},"url":"https://mcp.waymark.network/r/42eac6ab-152b-4e63-8a78-ec3b06a4509c"}