In this module we looked at how to audit AWS CloudTrail events with Sysdig Secure for Cloud. The Sysdig agent-less connector analyzes every CloudTrail entry in real time, and provides runtime protection using a flexible set of Falco rules, and can forward findings to AWS Security Hub, AWS CloudWatch, as well as to Sysdig Secure.