Achieve better AWS security with just 10 Cloudtrail logs alerts

CloudTrail logs track actions taken by a user, role, or an AWS service, whether taken through the AWS console or API operations. In contrast to on-premise-infrastructure where something as important as network flow monitoring (Netflow logs) could take weeks or months to get off the ground, AWS has the ability to track flow logs with a few clicks at relatively low cost.

Some basic tracking is enabled by default with AWS CloudWatch and CloudTrail, but you should review the configuration and use this guide to apply the most important best practices.

Most services publish CloudTrail events but only save the most recent events from the past 90 days. In order to save data long term, you’ll need to create a Trail and enable continuous delivery to an S3 bucket. By default, when you create a Trail, it captures data from all regions.

Integrating your Cloudtrail logs into Coralogix is super easy and requires you to simply deploy a Lambda. Integrate your Cloudtrail logs with Coralogix for smarter analytics. Regardless, most alerts in this post will work with any ELK based solution. (Note AWS Open Distro has alerts for ELK as OSS!)

Cloudtrail logs can help meeting your Security requirements

Today’s cloud based applications allow users unprecedented access which. Users can access the application using different end points or locations. It is very important for companies to understand quickly if application activity is hostile or part of normal business. In some companies security organizations will come up with a formal list of requirements for DevOps and engineering in order to satisfy internal risk management or outside auditing in case of regulated industries. Putting formality aside, it is essential for every AWS based company to monitor user, admin and application activities continuously and identify red flags or malicious activity. There is a reason for AWS making Cloudtrail logs available for customers.  

In this paper we will show examples of how Coralogix simple but powerful alerts’ capability, combined with AWS Cloudtrail, can help companies implement such security requirements. The first example includes details about the different fields in the alert page. Other example will focus on the use case (unless new alerts fields and options are introduced).

Below is a table with different CloudTrail alerts.

All the alerts below are of type Standard and the alert condition is notify Immediately.

For more information about Cloudtrail logs and other AWS logs, visit our extensive AWS logging guide.

This blog post focused on how to create security alerts based on AWS Cloudtrail logs. It showed some examples of such alerts. There is a vast universe of Cloudwatch logs out there. You will most likely have your own use case and requirements. So, you are encouraged to take the methods and concepts shown here and adapt them to your own needs. If you need help or have any questions, don’t hesitate to reach out to [email protected]. You can learn more about unlocking the value embedded in AWS and other logs in some of our other blog posts.