ActionTrail provides several ways to query events.
Use the following table to select a query method based on your use case.
Use case | Query method | References |
Query management events from the last 90 days | Event detail query You can use a single filter condition to query management events from the last 90 days. | |
Query events older than 90 days | Advanced event query After you enable advanced features on a trail, you can use multiple filter conditions to query management events, data events, and Insights events that are older than 90 days. | |
Query exceptional events | Insights event query You can use a single filter condition to query exceptional events in specific scenarios from the last 90 days. For example, an IPInsight event records access from an unusual IP address to help identify potential security risks. This query currently supports only management events. |