Query: cloudtrail_trail_global_service_logging_disabled

select
  tp_timestamp as timestamp,
string_split(event_source, '.')[1] || ':' || event_name as operation,
request_parameters ->> 'name' as resource,
user_identity.arn as actor,
tp_source_ip as source_ip,
tp_index as account_id,
aws_region as region,
tp_id as source_id,
*

from
  aws_cloudtrail_log
where
  event_source = 'cloudtrail.amazonaws.com'
  and event_name = 'UpdateTrail'
  and (request_parameters -> 'includeGlobalServiceEvents') = 'false'
  -- here we exclude console-based events by requiring 'session_credential_from_console' to be null, because console requests show all fields while CLI only shows updated fields.
  and session_credential_from_console is null
  and error_code is null

order by
  event_time desc;