> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CloudTrail Lookup Events

Looks up [management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-management-events) or [CloudTrail Insights events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-insights-events) that are captured by CloudTrail. You can look up events that occurred in a region within the last 90 days. Lookup supports the following attributes for management events:

* Amazon Web Services access key

* Event ID

* Event name

* Event source

* Read only

* Resource name

* Resource type

* User name

Lookup supports the following attributes for Insights events:

* Event ID

* Event name

* Event source

All attributes are optional. The default number of results returned is 50, with a maximum of 50 possible. The response includes a token that you can use to get the next page of results.

<Note>
  The rate of lookup requests is limited to two per second, per account, per region. If this limit is exceeded, a throttling error occurs.
</Note>

<Note>
  External Documentation

  To learn more, visit the [AWS documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.html).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter         | Description                                                                                                                                                                                                                                                               |
  | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | AWS Region(s)     | Enter the desired AWS Region(s).<br /><br />To execute the action in multiple regions, provide a comma-separated list.<br />For example: `us-east-1,eu-west-2`.<br /><br />If you wish to run the action in all available regions, use the asterisk symbol (`*`) instead. |
  | End Time          | Specifies that only events that occur before or at the specified time are returned.<br />If the specified end time is before the specified start time, an error is returned.                                                                                              |
  | Event Category    | Specifies the event category. If you do not specify an event category, events of the category are not returned in the response.<br />For example, if you do not specify insight as the value of EventCategory, no Insights events are returned.                           |
  | Lookup Attributes | Contains a list of lookup attributes.<br />Currently the list can contain only one item.                                                                                                                                                                                  |
  | Start Time        | Specifies that only events that occur after or at the specified time are returned.<br />If the specified start time is after the specified end time, an error is returned.                                                                                                |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter                        | Description                                                                                                                                                                                                                                                                                                                                           |
  | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Disable XML To JSON Auto Convert | When checked, XML responses are not automatically converted into JSON format.                                                                                                                                                                                                                                                                         |
  | Max Results                      | The number of events to return.<br />Possible values are 1 through 50.<br />The default is 50.                                                                                                                                                                                                                                                        |
  | Next Token                       | The token to use to get the next page of results after a previous API call.<br />This token must be passed in with the same parameters that were specified in the original call.<br />For example, if the original call specified an AttributeKey of 'Username' with a value of 'root', the call with NextToken should include those same parameters. |
</div>

## Example Output

```json theme={"dark"}
{
	"Events": [
		{
			"AccessKeyId": "string",
			"CloudTrailEvent": "string",
			"EventId": "string",
			"EventName": "string",
			"EventSource": "string",
			"EventTime": "date-time",
			"ReadOnly": "string",
			"Resources": [
				{
					"ResourceName": "string",
					"ResourceType": "string"
				}
			],
			"Username": "string"
		}
	],
	"NextToken": "string"
}
```

## Workflow Library Example

[Get Ip Activity from Aws Cloudtrail Logs](https://library.blinkops.com/workflows/get-ip-activity-from-aws-cloudtrail-logs)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/get-ip-activity-from-aws-cloudtrail-logs/canvas" />
</div>