CloudTrail Event Parser
Paste AWS CloudTrail events to get normalized actor, action, resource, auth and location fields, an explainable risk score, MITRE ATT&CK mapping and ready-to-paste investigation notes — entirely in your browser.
CloudTrail input
Paste one event, a
{"Records":[…]} batch, a JSON array, or JSON-lines. Parsing happens entirely in your browser.Examples:
Paste CloudTrail JSON or load an example to see the normalized summary, risk score and ATT&CK mapping.