Tools/AWS_CloudTrail
AWS CloudTrail
Account-level audit log for the AWS control plane — records every API call (console, CLI, SDK, service-to-service) with who, what, when, from where, and success/failure. The source-of-truth log that Amazon_GuardDuty analyzes for threat detection and AWS_Config correlates against for change tracking; usually the first thing pulled in an incident investigation. No direct open-source replacement (it's AWS's own control-plane log, not a third-party layer) — open-source tools sit downstream analyzing it, most commonly Wazuh via its built-in CloudTrail integration. Falco and auditd are the equivalents when the "account" is a Kubernetes cluster or a Linux host rather than AWS itself.