Documentation Index
Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
Use this file to discover all available pages before exploring further.
Triggers a workflow on every new event captured by CloudTrail.
Note: Events of type “LookupEvents” are filtered from the polling events.
Endpoint: https://cloudtrail.{region}.amazonaws.com/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.LookupEvents
Workflows with this trigger check for new events every 5 minutes by default. You can adjust this interval in the Trigger settings.
Parameters
| Parameter | Description |
|---|
| Event Category | Specifies the event category. If you do not specify an event category, events of the category are not returned in the response.
For example, if you do not specify insight as the value of EventCategory, no Insights events are returned. |
| Lookup Attributes | Contains a list of lookup attributes.
Currently the list can contain only one item. |
| Region | Region for the AWS command. |
Sample Event
{
"EventId": "654ccbc0-ba0d-486a-9076-dbf7274677a7",
"EventName": "DescribeEventAggregates",
"ReadOnly": "true",
"AccessKeyId": "ZZZZZZZZZZZZZZZZZZZZ",
"EventTime": 1737548601,
"EventSource": "cloudtrail.amazonaws.com",
"Username": "my-session-name",
"Resources": [],
"CloudTrailEvent": "{ \"eventVersion\": \"1.02\", \"userIdentity\": { \"type\": \"AssumedRole\", \"principalId\": \"AROAJIKPFTA72SWU4L7T4:my-session-name\", \"arn\": \"arn:aws:sts::123456789012:assumed-role/my-role/my-session-name\", \"accountId\": \"123456789012\", \"sessionContext\": { \"attributes\": { \"mfaAuthenticated\": \"false\", \"creationDate\": \"2016-01-26T21:42:12Z\" }, \"sessionIssuer\": { \"type\": \"Role\", \"principalId\": \"AROAJIKPFTA72SWU4L7T4\", \"arn\": \"arn:aws:iam::123456789012:role/my-role\", \"accountId\": \"123456789012\", \"userName\": \"my-role\" }}}, \"eventTime\": \"2016-01-26T21:42:12Z\", \"eventSource\": \"signin.amazonaws.com\", \"eventName\": \"ConsoleLogin\", \"awsRegion\": \"us-east-1\", \"sourceIPAddress\": \"72.21.198.70\", \"userAgent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36\", \"requestParameters\": null, \"responseElements\": { \"ConsoleLogin\": \"Success\" }, \"additionalEventData\": { \"MobileVersion\": \"No\", \"MFAUsed\": \"No\" }, \"eventID\": \"654ccbc0-ba0d-486a-9076-dbf7274677a7\", \"eventType\": \"AwsConsoleSignIn\", \"recipientAccountId\": \"123456789012\" }"
}
