turbot/tailpipe-mod-aws-cloudtrail-log-detections

Query: Top 10 Actors (Excluding AWS Services)

Description

List the top 10 actors by frequency, excluding AWS services and service roles.

Usage

powerpipe query aws_cloudtrail_log_detections.query.activity_dashboard_logs_by_actor

Tailpipe Tables

SQL

select
user_identity.arn as "Actor",
count(*) as "Logs"
from
aws_cloudtrail_log
where
user_identity.type != 'AWSService'
and user_identity.arn not like '%AWSServiceRole%'
group by
user_identity.arn
order by
count(*) desc
limit 10;

Dashboards

The query is used in the dashboards: