index="REPLACE_WITH_AWS_INDEX" sourcetype="aws:cloudtrail" earliest=-30d latest=now (userIdentity.accessKeyId="REPLACE_WITH_ACCESS_KEY_ID" OR userIdentity.arn="REPLACE_WITH_IAM_USER_ARN")
| table _time userIdentity.accessKeyId userIdentity.type userIdentity.arn eventSource eventName readOnly awsRegion sourceIPAddress userAgent errorCode recipientAccountId
| sort 0 _time
| head 500