Query: Ensure a log metric filter and alarm exist for AWS Management Console authentication failures

Description

You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Hub recommends that you create a metric filter and alarm for failed console authentication attempts.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
• 4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
• 4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
• 4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
• 4.6 Ensure AWS Management Console authentication failures are monitored
• 4.6 Ensure AWS Management Console authentication failures are monitored
• 4.6 Ensure AWS Management Console authentication failures are monitored
• 4.6 Ensure AWS Management Console authentication failures are monitored
• Ensure a log metric filter and alarm exist for AWS Management Console authentication failures

SQL