Generate Security Signals with Sumo Logic & AWS Cloudtrail

**Executive summary:** This post describes how to use AWS CloudTrail data in a SIEM (example: Sumo Logic) to detect risky or malicious activity in cloud environments, providing concrete detection use cases (suspicious logins with missing MFA and anomalous geolocation, account enumeration signaled by bursts of AccessDenied errors, persistence via Lambda creating keys or modifying policies, and log-deletion/StopLogging actions), example queries, tuning advice, and operational recommendations for alert triage and response.