MEDIUM
Source
CloudSploit
ID
cloudwatch-monitoring-metrics

CloudWatch Monitoring Metrics

Ensures metric filters are setup for CloudWatch logs to detect security risks from CloudTrail.

Sending CloudTrail logs to CloudWatch is only useful if metrics are setup to detect risky activity from those logs. There are numerous metrics that should be used. For the exact filter patterns, please see this plugin on GitHub: https://github.com/cloudsploit/scans/blob/master/plugins/aws/cloudwatchlogs/monitoringMetrics.js

Enable metric filters to detect malicious activity in CloudTrail logs sent to CloudWatch.