https://www.logsec.cloud/tags/cloudtrail/ Recent content in cloudtrail on logsec Hugo -- gohugo.io Tue, 20 Apr 2021 00:00:00 +0000 https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Tue, 20 Apr 2021 00:00:00 +0000 https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Seven Kibana (KQL) queries for spotting suspicious AWS CloudTrail activity, from disabled logging to backdoor access keys, mapped to MITRE ATT&CK. https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Sat, 20 Jun 2020 00:00:00 +0000 https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Splunk searches over CloudTrail logs that catch S3 buckets made public through the console, canned ACLs or grant flags, plus how to respond and prevent it. https://www.logsec.cloud/posts/ingest-cloudtrail-logs-to-splunk/ Mon, 20 Apr 2020 00:00:00 +0000 https://www.logsec.cloud/posts/ingest-cloudtrail-logs-to-splunk/ Build a Splunk lab on AWS with Terraform and ingest CloudTrail logs through S3 and SQS using the Splunk Add-on for AWS.