Skip to main content

💼 4 Monitoring

  • Contextual name: 💼 4 Monitoring
  • ID: /frameworks/cis-aws-v3.0.0/04
  • Located in: 💼 CIS AWS v3.0.0

Description​

This section contains recommendations for configuring AWS to assist with monitoring and responding to account activities.

Metric filter-related recommendations in this section are dependent on the Ensure CloudTrail is enabled in all regions and Ensure CloudTrail trails are integrated with CloudWatch Logs recommendation in the "Logging" section.

Similar​

  • Internal
    • ID: dec-b-adb4524e

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 4.1 Ensure unauthorized API calls are monitored - Level 2 (Manual)1
💼 4.2 Ensure management console sign-in without MFA is monitored - Level 1 (Manual)1
💼 4.3 Ensure usage of 'root' account is monitored - Level 1 (Manual)1
💼 4.4 Ensure IAM policy changes are monitored - Level 1 (Manual)1
💼 4.5 Ensure CloudTrail configuration changes are monitored - Level 1 (Manual)1
💼 4.6 Ensure AWS Management Console authentication failures are monitored - Level 2 (Manual)1
💼 4.7 Ensure disabling or scheduled deletion of customer created CMKs is monitored - Level 2 (Manual)1
💼 4.8 Ensure S3 bucket policy changes are monitored - Level 1 (Manual)1
💼 4.9 Ensure AWS Config configuration changes are monitored - Level 2 (Manual)1
💼 4.10 Ensure security group changes are monitored - Level 2 (Manual)1
💼 4.11 Ensure Network Access Control Lists (NACL) changes are monitored - Level 2 (Manual)1
💼 4.12 Ensure changes to network gateways are monitored - Level 1 (Manual)1
💼 4.13 Ensure route table changes are monitored - Level 1 (Manual)1
💼 4.14 Ensure VPC changes are monitored - Level 1 (Manual)1
💼 4.15 Ensure AWS Organizations changes are monitored - Level 1 (Manual)1
💼 4.16 Ensure AWS Security Hub is enabled - Level 2 (Automated)11