AWS CloudTrail events missing

[endakelly]

I've connected our AWS to Sentinel and events are being ingested but there seem to be missing events that I can see in CloudTrail and not in Sentinel.

Anybody experienced this before?

[#2]

@endakelly

Do you have some examples?  That would help the team answer or track why they are missing.

[#3 · Accepted solution]

@CliveWatson Think I've realised the problem. I've connected our org account to Sentinel and I assumed the logs from the sub-accounts would also flow in but you need to add the connector for each sub-account separately.

My bad :D

[#4]

No problem, glad you sorted it ;)