Logging, Monitoring, and Alerting in AWS (The TL;DR)
summary
Core recommendations: consolidate audit logs by enabling apply trail to all regions and disable duplicate global logging; enable object-level S3 data events and MFA delete for tamper-resistance; turn on VPC Flow Logs to CloudWatch and create alarms for brute-force and large egress patterns; use CloudWatch agents for host syslogs, AWS Config baseline rules plus multi-account multi-region delivery, and GuardDuty for managed-event detection; prefer exhausting native AWS logging/replication (Kinesis + Lambda) before buying third-party platforms.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:55AWS SHARED Responsibility Model
- 3:49Logging in AWS- Main Sources
- 4:33Logging in AWS - Setup/Config
- 13:58Monitoring/Alerting - General
- 14:18Logging, Monitoring, and Alerting in AWS (The TL;DR)
- 18:43Monitoring/Alerting - Native Tools
- 19:07Monitoring/Alerting - 3rd Party Tools
related talks
28mPatterns for scalable security detections on AWS
20mFantastic AWS Attacks and Where to Find Them
50mTo Normalized Logs, and Beyond - Building a Threat Detection...
25mUse lessons learned from the field to build for security
28mPatterns for scalable security detections on AWS
34mLayering AWS security services to automate incident response
18mHow AWS Partners use observability to strengthen customer security
32mAdvanced threat detection and response on AWS