Skip to content
AWS for Query.Farm

aws.cloudtrail.list_insights_metric_data

Example SQL Queries

SELECT * FROM
aws.cloudtrail.list_insights_metric_data
WHERE
"event_source" = 'VALUE'
AND "event_name" = 'VALUE'
AND "insight_type" = 'VALUE';

Description

Returns Insights metrics data for trails that have enabled Insights. The request must include the EventSource, EventName, and InsightType parameters.

If the InsightType is set to ApiErrorRateInsight, the request must also include the ErrorCode parameter.

The following are the available time periods for ListInsightsMetricData. Each cutoff is inclusive.

  • Data points with a period of 60 seconds (1-minute) are available for 15 days.

  • Data points with a period of 300 seconds (5-minute) are available for 63 days.

  • Data points with a period of 3600 seconds (1 hour) are available for 90 days.

Access to the ListInsightsMetricData API operation is linked to the cloudtrail:LookupEvents action. To use this operation, you must have permissions to perform the cloudtrail:LookupEvents action.

Table Definition

Column NameColumn Data Type
event_name Required Input Column

The name of the event, typically the Amazon Web Services API on which unusual levels of activity were recorded.

VARCHAR
event_source Required Input Column

The Amazon Web Services service to which the request was made, such as iam.amazonaws.com or s3.amazonaws.com.

VARCHAR
insight_type Required Input Column

The type of CloudTrail Insights event, which is either ApiCallRateInsight or ApiErrorRateInsight. The ApiCallRateInsight Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume. The ApiErrorRateInsight Insights type analyzes management API calls that result in error codes.

VARCHAR
data_type Input Column

Type of datapoints to return. Valid values are NonZeroData and FillWithZeros. The default is NonZeroData.

VARCHAR
end_time Input Column

Specifies, in UTC, the end time for time-series data. The value specified is exclusive; results include data points up to the specified time stamp.

The default is the time of request.

TIMESTAMP_S
error_code Input Column

Only returned if InsightType parameter was set to ApiErrorRateInsight.

If returning metrics for the ApiErrorRateInsight Insights type, this is the error to retrieve data for. For example, AccessDenied.

VARCHAR
max_results Input Column

The maximum number of datapoints to return. Valid values are integers from 1 to 21600. The default value is 21600.

BIGINT
next_token Input Column

Only returned if the full results could not be returned in a single query. You can set the NextToken parameter in the next request to this value to continue retrieval.

VARCHAR
period Input Column

Granularity of data to retrieve, in seconds. Valid values are 60, 300, and 3600. If you specify any other value, you will get an error. The default is 3600 seconds.

BIGINT
start_time Input Column

Specifies, in UTC, the start time for time-series data. The value specified is inclusive; results include data points with the specified time stamp.

The default is 90 days before the time of request.

TIMESTAMP_S
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
timestamps

List of timestamps at intervals corresponding to the specified time period.

TIMESTAMP_S[]
Show child fields
timestamps[]
values

List of values representing the API call rate or error rate at each timestamp. The number of values is equal to the number of timestamps.

DOUBLE[]
Show child fields
values[]