eventSource:cloudtrail.amazonaws.com (eventName:StopLogging OR eventName:UpdateTrail OR eventName:DeleteTrail)