Skip to content

Monitoring

CloudTrail

Tool Description
CloudTrail-Partitioner
  • Automatically organizes your CloudTrail logs in a format suitable for simple querying with Athena
TrailBlazer
  • Determine what AWS API calls are logged by CloudTrail and what they are logged as
  • You can also use TrailBlazer as an attack simulation framework
CloudTrail-Anomaly
  • CloudTrail based anomaly detection for use in AWS
  • It keeps track of all API actions a principal calls (that are tracked by CloudTrail) for a N day period and alerts on new API calls after the N day period
CloudTrail Insights
  • Identify and Respond to Unusual API Activity

Detection

Tool Description
Creds Compromise Detection
  • Detecting Credential Compromise in AWS
Detect Console Actions
  • Detecting Manual AWS Console Actions
  • Setup Cloudtrail alerting rules that let you detect when someone makes a manual change in the AWS Console
AWS Console Recorder
  • Records actions made in the AWS Management Console and outputs the equivalent CLI/SDK commands and CloudFormation/Terraform templates
DLP for S3
  • Simple way to detect cross account exfiltration from S3 buckets
Back to top