AWS DETECTION ENGINEERING: MASTERING LOG SOURCES FOR THREAT DETECTION

Summary from the TLDR InfoSec newsletter

This post provides an overview of how to utilize CloudTrail, VPC Flow Logs, GuardDuty, ALB Logs, and AWS Config for threat detection in AWS. It lists sample alerts for each data source, as well as cross-service alerts, and demonstrates how these alerts can inform automated enforcement actions. Continuous validation is important for ensuring that rules remain consistent with an organization's environment.