Ravi Sir's Cyber Security Cards › Revision Cards
Detection: CloudTrail, GuardDuty, Config and Security Hub
Detection: CloudTrail, GuardDuty, Config and Security Hub AWS tools that let you see what is happening. CloudTrail : who did what. GuardDuty : finds threats. Config : tracks settings. Security Hub : brings it together. Make a multi-region CloudTrail trail into a locked S3 bucket (Block Public Access
Read card text
What this card says
What it is
AWS tools that let you see what is happening.
CloudTrail: who did what. GuardDuty: finds threats. Config: tracks settings. Security Hub: brings it together.
Setup
Make a multi-region CloudTrail trail into a locked S3 bucket (Block Public Access, versioning).
Turn on GuardDuty and email the high-severity findings.
Why it matters for security
You cannot defend what you cannot see.
These logs and alerts are how you spot an attack early.
| Service | What it does |
|---|---|
| CloudTrail | Records every API call: who did what, when, from which IP |
| GuardDuty | Analyses CloudTrail, VPC Flow Logs and DNS logs to spot… |
| AWS Config | Tracks configuration changes and checks rules like "no… |
| Security Hub | Collects findings from GuardDuty, Config, Inspector and… |
Learn more in the lesson: 30.5 Detection: CloudTrail, GuardDuty, Config and Security Hub