Error and access logs surge during a possible compromise.
Detect the signal while controlling cost without losing evidence.
Which audit-log approach is most appropriate?
Extract metrics for ingestion volume, error codes, and principals and apply anomaly detection while retaining the logs.
Detailed explanation
The incident evidence would be lost.
The incident evidence would be lost.
A surge can trigger an alert while the underlying evidence remains protected.
A surge can trigger an alert while the underlying evidence remains protected.
Audit coverage is reduced during the most important period.
Audit coverage is reduced during the most important period.
Names do not reveal event content or actor behavior.
Names do not reveal event content or actor behavior.
Check official documentation
Compare the following points with the official documentation.
Amazon CloudWatch Logs metric filters、anomaly detection、CloudTrailの公式説明を確認する。
What to confirm
コスト削減のための削除と、異常検知・証跡保護の両立を説明できる。
Key points
- Metric filter
- Anomaly detection
- Log surge
- Evidence
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Detection dimensions
Split by principal, operation, error code, and source rather than watching only total volume.
Cost control
Use tiering or sampling only when it does not remove required audit events.