ConsoleLogin is the AWS authentication event recorded when a user signs in to the AWS Management Console. It appears in CloudTrail logs and is one of the most useful signals for monitoring interactive access to an AWS account, especially when reviewing root-user activity or other privileged logins.
In cyber security, ConsoleLogin matters because it helps defenders distinguish normal access from suspicious behavior. Repeated failures, logins from unusual locations, or unexpected sign-ins to a root account can indicate password spraying, credential stuffing, or account takeover attempts. Security teams often alert on failed ConsoleLogin events, correlate them with MFA status, and compare them with expected admin activity to spot low-and-slow attacks before they succeed.