Get Involved
Query: Ensure a log metric filter and alarm exist for CloudTrail configuration changes
Description
You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Hub recommends that you create a metric filter and alarm for changes to CloudTrail configuration settings. Monitoring these changes helps ensure sustained visibility to activities in the account.
Query
Tables used in this query:
- aws_account
- aws_cloudtrail_trail
- aws_cloudwatch_alarm
- aws_cloudwatch_log_metric_filter
- aws_sns_topic_subscription
Controls using this query:
- 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- 4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- 4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- 4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- 4.5 Ensure CloudTrail configuration changes are monitored
- 4.5 Ensure CloudTrail configuration changes are monitored
- 4.5 Ensure CloudTrail configuration changes are monitored
- 4.5 Ensure CloudTrail configuration changes are monitored
- Ensure a log metric filter and alarm exist for CloudTrail configuration changes