Skip to content

CloudTrail  >  Operations  >  list_insights_data

list_insights_data

Operation

list_insights_data async 

list_insights_data(input: ListInsightsDataInput, plugins: list[Plugin] | None = None) -> ListInsightsDataOutput

Returns Insights events generated on a trail that logs data events. You can list Insights events that occurred in a Region within the last 90 days.

ListInsightsData supports the following Dimensions for Insights events:

  • Event ID

  • Event name

  • Event source

All dimensions are optional. The default number of results returned is 50, with a maximum of 50 possible. The response includes a token that you can use to get the next page of results.

The rate of ListInsightsData requests is limited to two per second, per account, per Region. If this limit is exceeded, a throttling error occurs.

Parameters:

Name Type Description Default
input ListInsightsDataInput

An instance of ListInsightsDataInput.

 required
plugins list[Plugin] | None

A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations.

 None

Returns:

Type Description
ListInsightsDataOutput

An instance of ListInsightsDataOutput.

Input

ListInsightsDataInput dataclass

Dataclass for ListInsightsDataInput structure.

Attributes

data_type class-attribute instance-attribute 
data_type: ListInsightsDataType | None = None

Specifies the category of events returned. To fetch Insights events, specify InsightsEvents as the value of DataType

dimensions class-attribute instance-attribute 
dimensions: dict[str, str] | None = None

Contains a map of dimensions. Currently the map can contain only one item.

end_time class-attribute instance-attribute 
end_time: datetime | None = None

Specifies that only events that occur before or at the specified time are returned. If the specified end time is before the specified start time, an error is returned.

insight_source class-attribute instance-attribute 
insight_source: str | None = None

The Amazon Resource Name(ARN) of the trail for which you want to retrieve Insights events.

max_results class-attribute instance-attribute 
max_results: int | None = None

The number of events to return. Possible values are 1 through 50. The default is 50.

next_token class-attribute instance-attribute 
next_token: str | None = None

The token to use to get the next page of results after a previous API call. This token must be passed in with the same parameters that were specified in the original call. For example, if the original call specified a EventName as a dimension with PutObject as a value, the call with NextToken should include those same parameters.

start_time class-attribute instance-attribute 
start_time: datetime | None = None

Specifies that only events that occur after or at the specified time are returned. If the specified start time is after the specified end time, an error is returned.

Output

ListInsightsDataOutput dataclass

Dataclass for ListInsightsDataOutput structure.

Attributes

events class-attribute instance-attribute 
events: list[Event] | None = None

A list of events returned based on the InsightSource, DataType or Dimensions specified. The events list is sorted by time. The most recent event is listed first.

next_token class-attribute instance-attribute 
next_token: str | None = None

The token to use to get the next page of results after a previous API call. If the token does not appear, there are no more results to return. The token must be passed in with the same parameters as the previous call. For example, if the original call specified a EventName as a dimension with PutObject as a value, the call with NextToken should include those same parameters.