Query: Ensure a log metric filter and alarm exist for security group changes

Description

You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security groups are a stateful packet filter that controls ingress and egress traffic in a VPC. Security Hub recommends that you create a metric filter and alarm for changes to security groups. Monitoring these changes helps ensure that resources and services aren't unintentionally exposed.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.10 Ensure a log metric filter and alarm exist for security group changes
• 4.10 Ensure a log metric filter and alarm exist for security group changes
• 4.10 Ensure a log metric filter and alarm exist for security group changes
• 4.10 Ensure a log metric filter and alarm exist for security group changes
• 4.10 Ensure security group changes are monitored
• 4.10 Ensure security group changes are monitored
• 4.10 Ensure security group changes are monitored
• 4.10 Ensure security group changes are monitored
• Ensure a log metric filter and alarm exist for security group changes

SQL