The advanced event query feature enables advanced queries of events based on trails. This topic describes how to enable the advanced event query feature.

Prerequisites

A trail that meets the following conditions is created. For more information, see Create a single-account trail and Create a multi-account trail.
  • The trail delivers the events that occur in all regions.
  • The trail delivers all types of events.
  • The trail delivers events to Log Service.

Procedure

  1. Log on to the ActionTrail console.
  2. In the left-side navigation pane, click Trails.
  3. On the Trails page, find the trail for which you want to enable the advanced event query feature and click the name of the trail.
  4. Click Enable on the right of Default Trail for Advanced Event Query. Then, the advanced event query feature is enabled for the trail.
    Note You can click Cancel to disable the advanced event query feature.

Result

When Yes is displayed on the right of Default Trail for Advanced Event Query, the advanced event query feature is enabled for the trail.