Logging, threat detection and incident response

Why logging comes first

When something goes wrong, the first questions are: who did it, what did they touch, and when? Without logs you cannot answer, cannot prove anything to an auditor, and cannot tell a regulator what happened. Detection tools also read those logs, so logging is the foundation of everything in this topic.

AWS CloudTrail

CloudTrail records API calls: who (the identity), what (the event name, such as RunInstances), when, from which IP address, and whether it succeeded. The console's Event history keeps 90 days of management events for free. For anything longer, create a trail that delivers logs to an S3 bucket.

• Make it a multi-region trail, so activity in a region you never use (a favourite trick of attackers mining cryptocurrency) is still recorded.
• In AWS Organizations, create an organisation trail so every account, including new ones, is covered automatically.
• Send the logs to a bucket in a separate log-archive account, turn on log file integrity validation, and consider S3 Object Lock so nobody can delete or alter them.
• Data events (for example every S3 GetObject) are not logged by default and cost extra; enable them for sensitive buckets.

aws cloudtrail create-trail --name org-trail --s3-bucket-name acme-log-archive \
  --is-multi-region-trail --is-organization-trail --enable-log-file-validation
aws cloudtrail start-logging --name org-trail

# Who signed in to the console recently?
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --max-results 5

The AWS detection services

On Azure, Microsoft Defender for Cloud does posture checks and workload protection, and Microsoft Sentinel is a SIEM (security information and event management: a system that collects logs from many sources, correlates them and raises incidents). On Google Cloud, Security Command Center plays the role of Security Hub and GuardDuty together. AWS reorganised parts of Security Hub in 2025, so console names may differ; the ideas stay the same.

Network protection: security groups, WAF and Shield

Security groups are stateful firewalls on each instance or load balancer: allow only the ports you need (443 from the internet to the load balancer, the app port only from the load balancer). AWS WAF (web application firewall) inspects HTTP requests at CloudFront, an Application Load Balancer or API Gateway. Start with AWS Managed Rules (such as the core rule set and known bad inputs) and add a rate-based rule that blocks an IP sending too many requests, which stops simple login floods. AWS Shield Standard protects every customer against common network DDoS (distributed denial of service) attacks at no extra cost. Shield Advanced is a paid subscription with a one-year commitment that adds stronger protection, cost protection and access to the AWS response team.

Incident response basics in the cloud

1. Prepare: decide in advance who is on call, how they are paged, and keep a written runbook.
2. Contain: move a compromised instance into an isolation security group with no inbound or outbound rules. Do not terminate it; you would destroy evidence.
3. Preserve evidence: take EBS snapshots and tag them with the incident number; keep the CloudTrail logs.
4. Rotate credentials: disable leaked access keys, revoke active role sessions, change passwords and secrets the attacker could have seen.
5. Investigate: search CloudTrail for everything the identity did, in every region, from the first suspicious event.
6. Recover and learn: rebuild from clean images, fix the root cause, and write a blameless post-incident report. In India, check whether the incident must be reported to CERT-In within 6 hours (covered in the next topic).