💼 [CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs
Description
CloudTrail records AWS API calls that are made in a given account. The recorded
information includes the following:
- The identity of the API caller
- The time of the API call
- The source IP address of the API caller
- The request parameters
- The response elements returned by the AWS service
CloudTrail uses Amazon S3 for log file storage and delivery. You can capture
CloudTrail logs in a specified S3 bucket for long-term analysis. To perform real-time
analysis, you can configure CloudTrail to send logs to CloudWatch Logs.
For a trail that is enabled in all Regions in an account, CloudTrail sends log
files from all of those Regions to a CloudWatch Logs log group.
Similar
- AWS Security Hub
- Internal
Similar Sections (Give Policies To)
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|
| 💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions | | 11 | 13 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AC-4(26) Information Flow Enforcement _ Audit Filtering Actions | | | 7 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions | | 15 | 16 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-2 Event Logging | 4 | | 6 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-3 Content of Audit Records | 3 | 13 | 20 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-6(1) Audit Record Review, Analysis, and Reporting _ Automated Process Integration | | 1 | 1 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-6(3) Audit Record Review, Analysis, and Reporting _ Correlate Audit Record Repositories | | | 6 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-6(4) Audit Record Review, Analysis, and Reporting _ Central Review and Analysis | | | 6 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-6(5) Audit Record Review, Analysis, and Reporting _ Integrated Analysis of Audit Records | | | | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-7(1) Audit Record Reduction and Report Generation _ Automatic Processing | | 1 | 1 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-10 Non-repudiation | 5 | | 5 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation | 4 | 45 | 47 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring | 6 | | 8 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic | | | 7 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 SI-3(8) Malicious Code Protection _ Detect Unauthorized Commands | | | 3 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 SI-4(5) System Monitoring _ System-generated Alerts | | | | |
| 💼 NIST SP 800-53 Revision 5 → 💼 SI-4(20) System Monitoring _ Privileged Users | | | 3 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 SI-7(8) Software, Firmware, and Information Integrity _ Auditing Capability for Significant Events | | | 6 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 SI-20 Tainting | | | | |
| 💼 PCI DSS v3.2.1 → 💼 10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter. | | | | |
Sub Sections
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|