ActionTrail provides various methods for you to query events.
The following table describes the methods that you can use to query events in different scenarios.
Scenario | Query method | References |
Query events that were generated in the last 90 days | Perform event detail queries. You can perform event detail queries to query management events that were generated in the last 90 days. You can specify only one filter condition for each event detail query. | |
Query events that were generated more than 90 days ago | Perform advanced event queries. If you enable the advanced event query feature for an existing trail, you can perform advanced event queries to query management events and Insights events that were generated more than 90 days ago. You can specify multiple filter conditions for each advanced event query. | |
Query exceptional operations | Perform Insights event queries. You can perform Insights event queries to query exceptional operations that were performed in specific scenarios in the last 90 days. You can specify only one filter condition for each Insights event query. For example, an IPInsight event helps you gain an insight into an operation that was performed from an unusual IP address and identify potential risks at the earliest opportunity. You can perform online queries of IPInsight events that were generated in the last 90 days. |