[AWS Trumpet] Only partial CloudTrail logs compare...

Getting Data In

I am using the https://github.com/splunk/splunk-aws-project-trumpet to get AWS logs in, I am facing an issue though with only partial CloudTrail logs compared to the AWS TA. Any suggestions?

On the CloudFormation template does this effectively only collect this event pattern?

EventPattern":{
"detail-type":[
"AWS API Call via CloudTrail",
"AWS Console Sign In via CloudTrail"

Get Updates on the Splunk Community!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

[AWS Trumpet] Only partial CloudTrail logs compared to the AWS Add-on?