"Collecting logs" and "detecting signals" are entirely different problems. If CloudTrail records what happened, Amazon CloudWatch is the operational plane that quantifies those records, defines thresholds, and wakes people when thresholds are crossed. From a security exam perspective, CloudWatch is not merely a monitoring tool but the first transformer in a detection pipeline: "text log → metric → alarm → auto-response." The mechanism of this transformation — how logs become numbers and numbers become alerts — is the core.
CloudWatch bundles two distinct data models under one name.