Detection

Official references for this objective

• Amazon Web Services — Amazon Detective Documentation

  help you to answer your investigative questions without the complexity of querying raw logs. For example, a graph can provide context and relationships around when

• Amazon Web Services — Create a CloudWatch alarm based on anomaly detection - Amazon CloudWatch

  The expected values take into account the typical hourly, daily, and weekly patterns in the metric.

• Amazon Web Services — GuardDuty Extended Threat Detection - Amazon GuardDuty

  with foundational threat detection, GuardDuty can identify a potential attack sequence starting from IAM privilege discovery activity on Amazon S3 APIs

• Amazon Web Services — Understanding CloudTrail events - AWS CloudTrail

  By default, trails and event data stores log management events, but not data events, network activity events, or Insights events.

• Amazon Web Services — What is Amazon Detective? - Amazon Detective

  Your organization management account designates a Detective administrator account for the organization. The Detective administrator account enables organization accounts as member accounts in the organization

• Amazon Web Services — Introduction to AWS Security Hub CSPM - AWS Security Hub

  You can create automation rules that modify or suppress findings based on your defined criteria. Security Hub CSPM also supports an integration with Amazon EventBridge.

• Amazon Web Services — Security best practices in AWS CloudTrail - AWS CloudTrail

  Consider implementing ongoing detective controls to help ensure all trails are sending events to CloudWatch Logs for monitoring by using the cloud-trail-cloud-watch-logs-enabled rule in AWS

• Amazon Web Services — Using CloudWatch anomaly detection - Amazon CloudWatch

  These types of alarms don't have a static threshold for determining alarm state. Instead, they compare the metric's value to the expected value based on