Lesson 5 of 10

Cloud Logging, Monitoring & Threat Detection

You cannot defend what you cannot see. This lesson covers the cloud-native logging and monitoring services that give you visibility into your cloud environment — AWS CloudTrail, Azure Monitor, and GCP Cloud Audit Logs — and how to use them to detect attacks in progress. You will learn what events to alert on, how attackers try to evade logging, and how to build a basic cloud SIEM pipeline.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is a hands-on skill — you are learning to actually do something, not just understand it theoretically. The goal is muscle memory: being able to perform this action reliably under pressure, in a real engagement, without having to look it up every time. Practice until it feels automatic.

Why this matters

Cloud infrastructure now hosts the majority of the world's data and applications. Misconfigured cloud resources are responsible for some of the largest data breaches in history. Cloud security skills are among the most in-demand and highest-paying in the entire field.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Cloud Logging, Monitoring & Threat Detection · Objective 1 of 4

VIDEO

Loading video…

Verify CloudTrail is enabled

Check that a multi-region trail exists and is logging to an S3 bucket with log file validation enabled.

aws cloudtrail describe-trails --query "trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]" --output table

Enable GuardDuty

Enable GuardDuty in your account and region to start automated threat detection.

aws guardduty create-detector --enable --finding-publishing-frequency FIFTEEN_MINUTES

Create a CloudWatch alarm for root login

Alert whenever the root account is used — this should never happen in normal operations.

aws cloudwatch put-metric-alarm --alarm-name RootAccountUsage --metric-name RootAccountUsage --namespace CloudTrailMetrics --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarm-actions arn:aws:sns:us-east-1:123456789:SecurityAlerts

Review GuardDuty findings

List active GuardDuty findings sorted by severity to prioritize response.

aws guardduty list-findings --detector-id $(aws guardduty list-detectors --query "DetectorIds[0]" --output text) --finding-criteria file://gd-filter.json

Previous: Network Security in the Cloud Next Lesson