Amazon Web Services (AWS)

Alerts

• AWS CIS Control AWS Config configuration changed - This alert will be triggered when the configuration is changed in the AWS Config. it will help ensure sustained visibility of configuration items within the AWS account.
•  AWS CIS Control AWS Management Console authentication failures - This alert will be triggered in the event of any failed or unauthorized login attempt to the AWS management console.
• AWS CIS Control changes to Network Access Control Lists (NACL) detected - This alert will be triggered in the event of any changes to Network Access Control Lists is detected. Monitoring changes to NACLs will help ensure that the AWS resources and services are not unintentionally exposed.
• AWS CIS Control Changes to network gateways detected - This alert will be triggered in the event of any changes to the network gateway is detected. Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.
• AWS CIS Control CloudTrail configuration changed - This alert will be triggered in the event of any CloudTrail configuration is changed. Monitoring changes to CloudTrail's configuration will help ensure sustained visibility to activities performed in the AWS account.
• AWS CIS Control Disabling or scheduled deletion of customer created CMKs - This alert will be triggered in the event of any disabling or scheduled deletion of customer created CMKs. Monitoring changes to CloudTrail's configuration will help ensure sustained visibility to activities performed in the AWS account.
• AWS CIS Control IAM policy changed - This alert will be triggered in the event of any IAM policy changed. Monitoring changes to IAM policies will help ensure authentication and authorization controls remain intact.
• AWS CIS Control Management Console signed-in without MFA - This alert will be triggered in the event of any user signed-in without MFA. Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA.
• AWS CIS Control Route table changed - This alert will be triggered in the event of any Route table changed. Monitoring changes to route tables will help ensure that all VPC traffic flows through an expected path.
• AWS CIS Control S3 bucket policy changed - This alert will be triggered in the event of the s3 bucket policy changed. Monitoring changes to the S3 bucket policies may reduce the time to detect and correct permissive policies on sensitive S3 buckets.
• AWS CIS Control Security group changed - This alert will be triggered in the event of the s3 bucket policy changed. Monitoring changes to the security group will help ensure that resources and services are not unintentionally exposed.
• AWS CIS Control Unauthorized API calls - This alert is triggered in the event of unauthorized API calls detected. Monitoring unauthorized API calls will help reveal application errors and may reduce the time to detect malicious activity.
• AWS CIS Control Usage of root account detected - This alert will be triggered in the event of root account usage detected. Monitoring for root account logins will provide visibility into the use of a fully privileged account and an opportunity to reduce the use of it.
• AWS CIS Control VPC configuration changed - This alert will be triggered in the event of VPC changed. Monitoring changes to IAM policies will help ensure authentication and authorization controls remain intact.

Reports

• Amazon AWS Policy Activity – This report will generate a detailed view of the activities related to policy, i.e. AttachUserPolicy, GetPolicy, DetachRolePolicy, CreatePolicy, etc.
• Amazon AWS User Management Activity – This report will generate a detailed view of the activities related to user or group create, delete, add, remove, etc.

Reports

• Amazon AWS Login Success Activity – This report will generate a detailed view of the successful user login or authentication to the AWS management console.
• Amazon AWS Network Interface Activity – This report will generate a detailed view of the activity related to network interface create, delete, reset, modify, detach, attach, etc.
• Amazon AWS Bucket-Level Activity – This report will generate a detailed view of the activities related to the Amazon S3 bucket. This includes CreateBucket, PutBucketPolicy, ListBuckets, etc.

Alerts

• Amazon AWS Network Interface Deleted – – This alert will be triggered if there is any activity related to VPC network interface deletion.
• Amazon S3 User Deleted – This alert will be triggered if a user gets deleted.

Reports

• Amazon AWS Login Failed Activity – This report will generate a detailed view of failed or unauthorized logins to the AWS management console.
• Amazon AWS Security Group Activity – This report will generate a detailed view of the activities related to the security groups, i.e. CreateSecurityGroup, AuthorizeSecurityGroupIngress, DeleteSecurityGroup, etc.