CloudTrail can send logs to CloudWatch which allows metrics and threshold to be configured (as well as subscription filters or LogInsights).

CloudWatch logs have a size limitation of 256Kb, if CloudTrail logs are bigger, they wont be forwarded to CloudWatch.

CloudTrail DigitalCloud

Using specific filter patterns you can create Metrics (to detect for example when API calls requests change significantly or when EC2 instances are started or there are failed login attempts to the Management Console and so on) and then you can create Alarms specifying thresholds for your metrics.