Control: 2.19 Ensure a log monitoring and alerts are set up for Management Console authentication failures
Real-time monitoring of API calls can be achieved by directing ActionTrail Logs to Log Service and establishing corresponding query and alarms. It is recommended that a query and alarm be established for failed console authentication attempts.
Perform the following to ensure the log monitoring and alerts are set up for Management Console authentication failures:
- Logon to SLS Console.
Log Service Audit Servicein the navigation pane.
- Go to
Access to Cloud Products > Global Configurationpage.
- Select a location of project for logs.
- Check the
Action Trailand configure a proper days.
Saveto save the changes.
- Go to
Access to Cloud Products > Global Configurationsclick
Log Management > Actiontrail Log.
- In the search/analytics console, input below query
"event.eventName": ConsoleSignin and "event.errorCode" : * and not "event.errorCode" : "" | select count(1) as cnt
- Create a dashboard and set alert for the query result.
steampipe check alicloud_compliance.control.cis_v100_2_19
This control uses a named query:manual_control