Built an end-to-end CloudTrail log ingestion pipeline from AWS into Splunk. CloudTrail writes to S3, SNS notifications trigger ingestion, and SPL queries power dashboards for IAM activity monitoring, S3 access patterns, and security alerting. Debugged an S3 prefix mismatch that was silently breaking SNS notifications — a subtle issue that took careful log analysis to identify.