☁️
CTHFM: AWS
  • Welcome
  • Getting Started
    • Account Setup
  • AWS CLI
    • AWS CLI Overview
    • Installation
  • AWS Fundamentals
    • AWS Documentation
    • AWS Shared Responsibility Model
    • Organizational Hierarchy
    • AWS Principals
    • IAM Fundamentals
      • IAM Policy Components
      • IAM Documentation References
    • AWS Security Services Overview
    • AWS Core Services
    • AWS Frameworks
    • Regions and Availability Zones
  • SQL
    • SQL Refresher for Threat Hunting
  • Logging Reference
    • Cloudtrail
      • What is Cloudtrail?
      • Setting Up Cloudtrail
      • Cloudtrail Events Structure
      • Filtering and Searching CloudTrail Logs
      • IAM ID Prefixes
      • Additional Resources
      • API References
    • VPCFlow Logs
    • GuardDuty
      • Multi-Account Setup
      • GuardDuty Concepts
      • GuardDuty Finding References
      • S3 Protection
      • Malware Protection
        • EC2 Malware Protection
          • EC2 Protection Resources
          • Monitoring Scans
          • EC2 Malware Protection Events: CloudWatch
        • S3 Malware Protection
          • Enabling S3 Malware Protection
          • After Enabling S3 Malware Protection
          • S3 Malware Resource Plan Status
          • S3 Malware Protection Quotas
      • RDS Protection Enablement
      • Lambda Protection Enablement
      • Trusted IP Lists and Threat Lists in Amazon GuardDuty
      • Remediation Recommendations
      • GuardDuty API Reference
      • GuardDuty Quotas
    • Access Analyzer
      • Setup
      • External Access and Unused Access Analyzer Findings
      • Review Findings
      • Access Analyzer Resources
      • Access Analyzer API Reference
    • AWS Network Firewall
      • Permissions
      • Firewall Log Contents
      • Logging Destinations
      • CloudWatch Firewall Metrics
    • AWS Config
      • Resource Management in AWS Config
      • AWS Config Integrations
      • AWS Config Resources
      • Configuration Item
      • Config Rules
        • Evaluation Modes
  • CloudWatch
    • Amazon CloudWatch
      • CloudWatch Concepts
      • CloudWatch Metrics
        • Filter Pattern Syntax
      • CloudWatch Alarms
        • Alarm Recommendations
      • Subscriptions
      • CloudWatch Agent
      • CloudWatch Insights
        • Supported Logs and Discovered Fields
        • CloudWatch Insights Query Syntax
      • Anomaly Detection
        • Create Anomaly Detector
        • Alarms for Anomaly Detections
      • CloudWatch Filter Syntax
      • CloudWatch Service Quota
  • Athena For Threat Hunting
    • Introduction to Athena
    • Setting Up Athena
    • SQL For Threat Hunters
    • Automated Response
    • Query Best Practices
  • AWS Security Research and Resources
    • AWS Security Blog
    • AWS Goat
    • Cloud Goat
    • Pacu
    • Prowler
    • Scout Suite
  • Threat Hunting in AWS
    • Threat Hunting in AWS
    • Threat Hunting Introduction
    • Threat Hunting Process
      • Hypothesis Generation
      • Investigation
      • Identification
      • Resolution & Follow Up
    • Pyramid of Pain
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Att&CK Data Sources
      • MITRE Att&CK Mitigations
    • MITRE Att&ck: AWS
      • MITRE Att&CK Matrix
      • Amazon Web Services Security Control Mappings
    • AWS Threat Hunting Ideas
      • AWS Threat Hunting Ideas: EC2
      • AWS Threat Hunting Ideas: Lambda
      • AWS Threat Hunting Ideas: SQS
      • AWS Threat Hunting Ideas: SNS
      • AWS Threat Hunting Ideas: RDS
Powered by GitBook
On this page
  • Introduction
  • Key Concepts in AWS CloudTrail
  • How CloudTrail Concepts Apply in Practice
  1. Logging Reference

Cloudtrail

Introduction

To effectively use AWS CloudTrail, it's important to understand the core concepts that underpin how the service operates. In this lesson, we’ll explore the key components of CloudTrail, including events, trails, log files, and CloudTrail’s architecture. This foundational knowledge will equip you with the understanding necessary to configure and manage CloudTrail effectively.

Key Concepts in AWS CloudTrail

  1. Events

    • Definition: An event in CloudTrail refers to an occurrence of an API call or an activity that takes place within your AWS environment. These events are recorded and stored in log files by CloudTrail.

    • Types of Events:

      • Management Events: These events capture control plane operations that manage resources in your AWS account. Examples include creating or deleting an EC2 instance, updating security groups, or modifying IAM roles.

      • Data Events: These events provide visibility into the resource operations performed on or within a resource, such as S3 object-level operations (e.g., GetObject, PutObject) or Lambda function executions. Data events are not logged by default due to the high volume of data they can generate, but they can be enabled for specific resources.

  2. Trails

    • Definition: A trail is a configuration that enables CloudTrail to deliver log files to an S3 bucket. It defines the settings for capturing events across your AWS account and regions.

    • Single-Region vs. Multi-Region Trails:

      • Single-Region Trail: This trail type records events from a specific AWS region. It is useful for monitoring and logging activity in a particular geographic location.

      • Multi-Region Trail: This trail records events from all regions in your AWS account. It provides a comprehensive view of your account activity and is ideal for organizations with resources deployed in multiple regions.

    • Global Service Events: By default, a trail will capture global service events, such as IAM or AWS STS operations, that are common across all regions. These are included in all trails, ensuring that key security-related activities are logged regardless of the region in which they occur.

  3. Log Files

    • Structure and Format: CloudTrail log files are delivered in a structured JSON format. Each log file contains one or more records, with each record representing an event. The log files are designed for easy parsing and integration with log analysis tools.

    • Log Delivery: CloudTrail delivers log files to an S3 bucket that you specify during trail configuration. You can control the frequency of log file delivery, with options ranging from every five minutes to every hour.

    • Log File Integrity: CloudTrail offers the option to enable log file validation, which helps ensure that log files have not been tampered with. This is achieved using SHA-256 hash functions and digital signatures.

  4. CloudTrail Architecture

    • Event Collection: CloudTrail collects API call information from all AWS services and regions. It captures details such as the identity of the API caller, the time of the call, the source IP address, the request parameters, and the response elements returned by the AWS service.

    • Log Aggregation: CloudTrail aggregates these events into log files that are delivered to an S3 bucket. You can set up multiple trails to aggregate logs for different purposes, such as separate trails for management events and data events.

    • Integration Points:

      • Amazon S3: The primary storage for CloudTrail logs. Logs are stored in a designated S3 bucket, where they can be accessed, archived, or analyzed.

      • AWS CloudWatch: CloudTrail can be integrated with CloudWatch to monitor and alert on specific events. This integration enables real-time visibility and automated responses to critical activities.

      • AWS Lambda: You can create Lambda functions that are triggered by specific CloudTrail events, allowing you to automate actions such as sending notifications, generating reports, or invoking security measures.

      • AWS Athena: Athena can be used to query CloudTrail logs stored in S3, allowing you to run SQL-like queries on the logs for deep analysis and reporting.

  5. Management and Security

    • Access Control: CloudTrail logs are sensitive and should be secured. Access to the S3 bucket where logs are stored should be restricted using IAM policies, bucket policies, and encryption.

    • Log Retention: You can configure how long to retain CloudTrail logs in S3. It’s crucial to balance the need for long-term audit trails with cost considerations.

    • Monitoring and Alerts: By integrating CloudTrail with CloudWatch, you can set up alerts for specific events or patterns that may indicate security incidents or operational issues.

How CloudTrail Concepts Apply in Practice

  • Monitoring API Calls: By understanding the distinction between management and data events, you can configure CloudTrail to log only the activities that are most relevant to your security posture. For example, you might want to monitor all IAM-related API calls (management events) but only specific S3 operations (data events).

  • Setting Up Trails for Different Purposes: You can create multiple trails to serve different purposes. A multi-region trail can be used for compliance monitoring across your entire AWS account, while single-region trails might be set up to monitor specific geographic areas for operational efficiency.

  • Log File Analysis: Knowing the structure of CloudTrail log files enables you to quickly parse and analyze them using tools like Athena, making it easier to identify security incidents or audit compliance with organizational policies.

  • Integration for Enhanced Security: By integrating CloudTrail with other AWS services, such as CloudWatch and Lambda, you can automate responses to specific events, improving your ability to detect and respond to threats in real-time.

PreviousSQL Refresher for Threat HuntingNextWhat is Cloudtrail?

Last updated 8 months ago