<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Investigating AWS CloudTrail Logs

## Tools

### CloudTrail

| Command | Description |
|---|---|
| `aws cloudtrail lookup-events` | Query |
| `agent.js query` | Search |
| `agent.js timeline` | Timeline |
| `agent.js analyze` | IAM |

### Agent Script

```bash
node agent.js query --event-name <value>
node agent.js timeline --trail <value>
node agent.js analyze --principal <value>
node agent.js report --investigation <value>
```
