Consultant at a tech services company with 11-50 employees
Reseller
May 27, 2020
CloudTrail logs are an excellent and necessary way to monitor activity in your AWS environment. They are the "under-the-hood" audit logs much like
OS audit data, but covering the entire cloud infrastructure. This could include things like new compute instances created, user credentials changing, new encryption keys used, databases modified, and so much more. Essentially it covers anything done through the AWS console or APIs for your various cloud services. You really need to bring those logs into a SIEM or UEBA to leverage them properly, and you need to have good alerting
triggers, correlation rules and/or behavioral models setup to tell you when something suspicious happens.
Log Management centralizes the collection, analysis, and storage of log data from diverse systems, providing valuable insights into system performance and security events. It enables organizations to enhance visibility and streamline their IT operations. A comprehensive Log Management solution offers centralized log data aggregation, simplifying the monitoring of network infrastructure and applications. By providing real-time analytics, these solutions help detect anomalies, track trends,...
CloudTrail logs are an excellent and necessary way to monitor activity in your AWS environment. They are the "under-the-hood" audit logs much like
OS audit data, but covering the entire cloud infrastructure. This could include things like new compute instances created, user credentials changing, new encryption keys used, databases modified, and so much more. Essentially it covers anything done through the AWS console or APIs for your various cloud services. You really need to bring those logs into a SIEM or UEBA to leverage them properly, and you need to have good alerting
triggers, correlation rules and/or behavioral models setup to tell you when something suspicious happens.