Forensic investigations live or die on detail. In AWS, CloudTrail is that detail. Yet, even when logs are flowing, most teams trip over manual searches or half-baked automation. They waste hours sifting JSON instead of finding the incident's root cause. The gap isn’t lack of data—it’s lack of fast, repeatable queries that surface the evidence.
CloudTrail query runbooks are the missing weapon. With a well-designed runbook, you define the exact questions for your investigation before trouble arrives. You can track unauthorized IAM changes, pinpoint suspicious IPs, map a compromised role’s movements, or see every object touched in S3 after a breach alert. Every query is a command in your playbook, ready to run the moment you need it.
Building the right runbooks means choosing events that matter to your security posture. Focus on patterns of API calls that are either rare or carry high risk—DeleteBucket, AssumeRole from unusual accounts, changes to CloudTrail itself. Use filters for timeframes, resources, and principals to narrow the noise. Store queries in version control. Make them easy for any team member to fire off with the same accuracy at 2 a.m. as at noon.