bump.in.the.log
aws · cloudtrail · json

AWS CloudTrail log analysis for SOC analysts.

Paste raw CloudTrail JSON. BumpInTheLog parses the event records, reconstructs the chronology of the API calls, flags the anomalies worth your attention, and maps them to MITRE ATT&CK with the pivots to run next.

Analyze CloudTrail logsSee a CloudTrail example
cloudtrail_events.json
{"eventTime":"2026-05-10T03:11:42Z","eventName":"ConsoleLogin",
 "userIdentity":{"userName":"alice"},"responseElements":{"ConsoleLogin":"Failure"}}
{"eventTime":"2026-05-10T03:12:08Z","eventName":"ConsoleLogin",
 "userIdentity":{"userName":"evan"},"responseElements":{"ConsoleLogin":"Failure"}}
{"eventTime":"2026-05-10T03:12:41Z","eventName":"ConsoleLogin",
 "userIdentity":{"userName":"jsmith"},"additionalEventData":{"MFAUsed":"No"},
 "responseElements":{"ConsoleLogin":"Success"}}
{"eventTime":"2026-05-10T03:13:02Z","eventName":"CreateAccessKey", ... }
{"eventTime":"2026-05-10T03:34:11Z","eventName":"AttachUserPolicy", ... }
bumpinthelog.findings
03:11:42Password spray against console (8 principals)
03:12:41jsmith: ConsoleLogin success, MFAUsed=No
03:13:02CreateAccessKey for compromised principal
03:14:18Recon: ListBuckets, DescribeInstances
03:34:11AttachUserPolicy: svc_backup_helper +Admin
↑ 2 bumps flagged. Probable IAM credential compromise. T1110.003, T1098.001.

CloudTrail JSON parsing

Understands eventName, eventSource, userIdentity, sourceIPAddress, errorCode, assumed-role sessions and request parameters. Truncated or mixed dumps are handled without preprocessing.

Attack chronology

The API calls are reordered into a plain-English story: initial access, key creation, enumeration, privilege escalation and persistence, each with timestamps and severity.

MITRE ATT&CK and pivots

Findings map to ATT&CK techniques for cloud, with prioritized next steps and sample queries for Athena, CloudWatch Logs Insights, SPL and KQL.

CloudTrail patterns we look for

The events that usually mark the start of a cloud incident.

Credential access

ConsoleLogin failure bursts, logins without MFA, GetSessionToken and unusual sourceIPAddress or user agent.

Persistence

CreateAccessKey, CreateUser, CreateLoginProfile and AttachUserPolicy on service principals that never change.

Privilege escalation

PutUserPolicy, AttachRolePolicy, PassRole and UpdateAssumeRolePolicy granting wildcard permissions.

Defense evasion

StopLogging, DeleteTrail, PutEventSelectors narrowing coverage and GuardDuty detector changes.

Discovery

Bursts of ListBuckets, DescribeInstances, GetAccountAuthorizationDetails and ListRoles from one session.

Exfiltration

GetObject volume spikes, PutBucketPolicy or PutBucketAcl opening access, and cross-account snapshot sharing.

CloudTrail analysis questions

What CloudTrail formats can I paste?
Raw CloudTrail JSON records, the Records array from an S3 export, CloudWatch Logs Insights output, or lines copied straight from the AWS console event history. Mixed or partial dumps are fine, the parser auto-detects the shape.
Does BumpInTheLog store my CloudTrail events?
No. Raw log text is never persisted. Only the structured analysis result is stored so you can revisit the investigation with a share link.
Can I strip account IDs and IPs first?
Yes. The built-in redactor replaces public IPs, emails, internal hostnames, AWS access key IDs and account identifiers with stable placeholders before anything leaves your browser.
Are findings mapped to MITRE ATT&CK?
Where the evidence supports it. CloudTrail patterns like ConsoleLogin failures, CreateAccessKey, AttachUserPolicy and StopLogging map to techniques such as T1110.003, T1098.001 and T1562.008, each with a confidence rating.
Start a CloudTrail investigationHow your logs are handled