Skip to content

Latest commit

 

History

History
41 lines (37 loc) · 5.73 KB

cloudwatch-monitoring-metrics.md

File metadata and controls

41 lines (37 loc) · 5.73 KB
Raw

CloudSploit

AWS / CloudWatchLogs / CloudWatch Monitoring Metrics

Quick Info
Plugin Title CloudWatch Monitoring Metrics
Cloud AWS
Category CloudWatchLogs
Description Ensures metric filters are setup for CloudWatch logs to detect security risks from CloudTrail.
More Info Sending CloudTrail logs to CloudWatch is only useful if metrics are setup to detect risky activity from those logs. There are numerous metrics that should be used. For the exact filter patterns, please see this plugin on GitHub: https://github.com/cloudsploit/scans/blob/master/plugins/aws/cloudwatchlogs/monitoringMetrics.js
AWS Link http://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html
Recommended Action Enable metric filters to detect malicious activity in CloudTrail logs sent to CloudWatch.

Detailed Remediation Steps

  1. Log into the AWS Management Console.
  2. Select the "Services" option and search for CloudWatch.
  3. Scroll down the left navigation panel and choose "Alarms".
  4. On the "Alarms" page click on the "Settings" button below "Create alarm" button to open the CloudWatch dashboard.

  5. In the "Preference" tab scroll down the page and select the "Metric Name" toggle button and click on the "Confirm" button to save the changes.

  6. On the "Alarms" page check under "Metric Name" check any available alarm for the “CloudTrailEventCount” and if there is no such then the CloudTrail security threats are not monitored usinf CloudWatch.

  7. Repeat step nu,ber 2 - 6 to verify "CloudWatch Monitoring Metrics" for other regions.
  8. Select the "Services" option and search for "SNS" for creating a simple notification service to send notifications when "CloudWatch alarm" is triggered.
  9. On the "Amazon SNS" page scroll down the left navigation panel and choose "Topics" and click on the "Create topic" button at the extreme right.
  10. In the "Create topic" page enter the "Name" and "Display name" for the topic and click on the "Create topic" button at the bottom.
  11. Access the newly created topic by clicking on the "Name" of the topic.
  12. Select the "Subscription" tab from the bottom dashboard and click on the "Create Subscription" button.
  13. Select the "Email" as "Protocol" from the dropdown menu and enter the email address that can receive notifications from "Amazon SNS" and click on the "Create subscription" button.
  14. Confirm the "Subscription" by clicking on the link on your email id for the "Amazon SNS" topic.
  15. Navigate to "CloudWatch" dashboard and select "Logs" from the left navigation panel.
  16. On the "Log Groups" page select the log group created for the CloudTrail trail event logs and click Create Metric Filter button at the top.
  17. On the "Filter Patter" specify the terms or patterns to match log events to create metrics and click on the "Assign Metric" button at the bottom.
  18. On the "Create Metric Filter and Assign a Metric" page enter a name for the filter name and enter a name for "Metric Namespace" and "Metric Name" and click on the "Create Filter" button.
  19. Click on the "Create Alarm" button on the same page.
  20. On the "Specify metric and conditions" tab define the "Conditions" for threshold value and enter the threshold value and click on the "Next" button.
  21. On the "Configure actions" tab select the "Notification" ans "SNS Topic" by clicking on the "Select an existing SNS topic" and click on the "Next" button.
  22. On the "Add a description" tab enter the "Alarm name" and "Alarm description" and click on the "Next" button.
  23. On the "Preview and create" page review the settings and click on the "Create alarm" button at the bottom.
  24. Repeat steps number 8 - 23 to enable metric filters to detect malicious activity in CloudTrail logs sent to CloudWatch.