Alerting should be done by the centralized logging system.
The alerts generated by this are not very helpful:
{"s3Bucket":"cloudtrail-trailbucket-xxx","s3ObjectKey":["AWSLogs/xxx/CloudTrail/us-east-1/2017/09/04/xxx_CloudTrail_us-east-1_xxx_xxx.json.gz"]}
Alerting should be done by the centralized logging system.
The alerts generated by this are not very helpful: