Skip to content

MCSB_v1 - Logging and Threat Detection

ID Control Domain CIS Controls v7.1 ID(s) CIS Controls v8 ID(s) NIST SP800-53 r4 ID(s) PCI-DSS v3.2.1 ID(s) Recommendation Security Principle Azure Guidance Implementation and additional context AWS Guidance Implementation and additional context.1 AWS Config Rule (WIP) Customer Security Stakeholders:
LT-1 Logging and threat detection 6.7 - Regularly Review Logs 8.11 - Conduct Audit Log Reviews AU-3: CONTENT OF AUDIT RECORDS Enable threat detection capabilities To support threat detection scenarios, monitor all known resource types for known and expected threats and anomalies. Configure your alert filtering and analytics rules to extract high-quality alerts from log data, agents, or other data sources to reduce false positives. Use the threat detection capability of Microsoft Defender for Cloud for the respective Azure services. Introduction to Microsoft Defender for Cloud: Use Amazon GuardDuty for threat detection which analyzes and processes the following data sources: VPC Flow Logs, AWS CloudTrail management event logs, CloudTrail S3 data event logs, EKS audit logs, and DNS logs. GuardDuty is capable of reporting on security issues such as privilege escalation, exposed credential usage , or communication with malicious IP addresses, or domains. Amazon GuardDuty: nan Infrastructure and endpoint security: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-infrastructure-endpoint
AU-6: AUDIT REVIEW, ANALYSIS, AND REPORTING https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html
AU-12: AUDIT GENERATION For threat detection not included in Microsoft Defender services, refer to Microsoft Cloud Security Benchmark service baselines for the respective services to enable the threat detection or security alert capabilities within the service. Ingest alerts and log data from Microsoft Defender for Cloud, Microsoft 365 Defender, and log data from other resources into your Azure Monitor or Microsoft Sentinel instances to build analytics rules, which hunt detect threats and create alerts that match specific criteria across your environment. Configure AWS Config to check rules in SecurityHub for compliance monitoring such as configuration drift, and create findings when needed. Security operations: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-operations-center
SI-4: INFORMATION SYSTEM MONITORING Microsoft Defender for Cloud security alerts reference guide: Amazon GuardDuty data sources:
For Operational Technology (OT) environments that include computers that control or monitor Industrial Control System (ICS) or Supervisory Control and Data Acquisition (SCADA) resources, use Microsoft Defender for IoT to inventory assets and detect threats and vulnerabilities. https://docs.microsoft.com/azure/security-center/alerts-reference For threat detection not included in GuardDuty and SecurityHub, enable threat detection or security alert capabilities within the supported AWS services. Extract the alerts to your CloudTrail, CloudWatch, or Microsoft Sentinel to build analytics rules, which hunt threats that match specific criteria across your environment. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html Posture management: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-posture-management
For services that do not have a native threat detection capability, consider collecting the data plane logs and analyze the threats through Microsoft Sentinel. Create custom analytics rules to detect threats: You can also use Microsoft Defender for Cloud to monitor certain services in AWS such as EC2 instances. Connect your AWS accounts to Microsoft Defender for Cloud: Application Security and DevOps: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops
https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings
For Operational Technology (OT) environments that include computers that control or monitor Industrial Control System (ICS) or Supervisory Control and Data Acquisition (SCADA) resources, use Microsoft Defender for IoT to inventory assets and detect threats and vulnerabilities. Threat intelligence: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-threat-intelligence
Threat indicators for cyber threat intelligence in Microsoft Sentinel: How Defender for Cloud Apps helps protect your Amazon Web Services (AWS) environment
https://docs.microsoft.com/azure/architecture/example-scenario/data/sentinel-threat-intelligence https://docs.microsoft.com/en-us/defender-cloud-apps/protect-aws
Security recommendations for AWS resources - a reference guide:
https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws
LT-2 Logging and threat detection 4.9 - Log and Alert on Unsuccessful Administrative Account Login 8.11 - Conduct Audit Log Reviews AU-3: CONTENT OF AUDIT RECORDS 10.6 Enable threat detection for identity and access management Detect threats for identities and access management by monitoring the user and application sign-in and access anomalies. Behavioral patterns such as excessive number of failed login attempts, and deprecated accounts in the subscription, should be alerted. Azure AD provides the following logs that can be viewed in Azure AD reporting or integrated with Azure Monitor, Microsoft Sentinel or other SIEM/monitoring tools for more sophisticated monitoring and analytics use cases: Audit activity reports in Azure AD: AWS IAM provides the following reporting the logs and reports for console user activities through IAM Access Advisor and IAM credential report: IAM credential reports: nan Infrastructure and endpoint security: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-infrastructure-endpoint
6.7 - Regularly Review Logs AU-6: AUDIT REVIEW, ANALYSIS, AND REPORTING 10.8 - Sign-ins: The sign-ins report provides information about the usage of managed applications and user sign-in activities. https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs - Every successful sign-in and unsuccessful login attempts. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html
16.13 - Alert on Account Login Behavior Deviation AU-12: AUDIT GENERATION A3.5 - Audit logs: Provides traceability through logs for all changes done by various features within Azure AD. Examples of audit logs include changes made to any resources within Azure AD like adding or removing users, apps, groups, roles and policies. - Multi-factor authentication (MFA) status for each user. Security operations: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-operations-center
SI-4: INFORMATION SYSTEM MONITORING - Risky sign-ins: A risky sign-in is an indicator for a sign-in attempt that might have been performed by someone who is not the legitimate owner of a user account. Enable Azure Identity Protection: - Dormant IAM user GuardDuty data source:
- Users flagged for risk: A risky user is an indicator for a user account that might have been compromised. https://docs.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html Posture management: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-posture-management
For API level access monitoring and threat detection, use Amazon GuadDuty to identify the findings related to the IAM. Examples of these findings include:
Azure AD also provides an Identity Protection module to detect and remediate risks related to user accounts and sign-in behaviors. Examples of risks include leaked credentials, sign-in from anonymous or malware linked IP addresses, password spray. The policies in Azure AD Identity Protection allow you to enforce risk-based MFA authentication in conjunction with Azure Conditional Access on user accounts. Threat protection in Microsoft Defender for Cloud: - An API used to gain access to an AWS environment and was invoked in an anomalous way, or was used to evade defensive measures GuardDuty IAM finding types: Application Security and DevOps: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops
https://docs.microsoft.com/azure/security-center/threat-protection - An API used to: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html
In addition, Microsoft Defender for Cloud can be configured to alert on deprecated accounts in the subscription and suspicious activities such as an excessive number of failed authentication attempts. In addition to the basic security hygiene monitoring, Microsoft Defender for Cloud's Threat Protection module can also collect more in-depth security alerts from individual Azure compute resources (such as virtual machines, containers, app service), data resources (such as SQL DB and storage), and Azure service layers. This capability allows you to see account anomalies inside the individual resources. a) discover resources was invoked in an anomalous way Threat intelligence: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-threat-intelligence
Overview of Microsoft Defender for Identity: b) collect data from an AWS environment was invoked in an anomalous way.
Note: If you are connecting your on-premises Active Directory for synchronization, use the Microsoft Defender for Identity solution to consume your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. https://learn.microsoft.com/defender-for-identity/what-is b) tamper with data or processes in an AWS environment was invoked in an anomalous way.
c) gain unauthorized access to an AWS environment was invoked in an anomalous way.
d) maintain unauthorized access to an AWS environment was invoked in an anomalous way.
e) obtain high-level permissions to an AWS environment was invoked in an anomalous way.
f) be invoked from a known malicious IP address.
g) be invoked using root credentials.
- AWS CloudTrail logging was disabled.
- Account password policy was weakened.
- Multiple worldwide successful console logins were observed.
- Credentials that were created exclusively for an EC2 instance through an Instance launch role are being used from another account within AWS.
- Credentials that were created exclusively for an EC2 instance through an Instance launch role are being used from an external IP address.
- An API was invoked from a known malicious IP address.
- An API was invoked from an IP address on a custom threat list.
- An API was invoked from a Tor exit node IP address.
LT-3 Logging and threat detection 6.2 - Activate Audit Logging 8.2 - Collect Audit Logs AU-3: CONTENT OF AUDIT RECORDS 10.1 Enable logging for security investigation Enable logging for your cloud resources to meet the requirements for security incident investigations and security response and compliance purposes. Enable logging capability for resources at the different tiers, such as logs for Azure resources, operating systems and applications inside in your VMs and other log types. Understand logging and different log types in Azure: Use AWS CloudTrail logging for management events (control plane operations) and data events (data plane operations) and monitor these trails with CloudWatch for automated actions. Enabling logging from certain AWS services: nan Infrastructure and endpoint security: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-infrastructure-endpoint
6.3 - Enable Detailed Logging 8.5 - Collect Detailed Audit Logs AU-6: AUDIT REVIEW, ANALYSIS, AND REPORTING 10.2 https://docs.microsoft.com/azure/azure-monitor/platform/platform-logs-overview https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html
8.8 - Enable Command-Line Audit Logging 8.12 - Collect Service Provider Logs AU-12: AUDIT GENERATION 10.3 Be mindful about different types of logs for security, audit, and other operational logs at the management/control plane and data plane tiers. There are three types of the logs available at the Azure platform: The Amazon CloudWatch Logs service allows you to collect and store logs from your resources, applications, and services in near real time. There are three main categories of logs: Security operations: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-operations-center
SI-4: INFORMATION SYSTEM MONITORING - Azure resource log: Logging of operations that are performed within an Azure resource (the data plane). For example, getting a secret from a key vault or making a request to a database. The content of resource logs varies by the Azure service and resource type. Understand Microsoft Defender for Cloud data collection: - Vended logs: Logs natively published by AWS services on your behalf. Currently, Amazon VPC Flow Logs and Amazon Route 53 logs are the two supported types. These two logs are enabled by default. https://docs.aws.amazon.com/whitepapers/latest/introduction-aws-security/monitoring-and-logging.html
- Azure activity log: Logging of operations on each Azure resource at the subscription layer, from the outside (the management plane). You can use the Activity Log to determine what, who, and when for any write operations (PUT, POST, DELETE) taken on the resources in your subscription. There is a single Activity log for each Azure subscription. https://docs.microsoft.com/azure/security-center/security-center-enable-data-collection - Logs published by AWS services: Logs from more than 30 AWS services publish to CloudWatch. They include Amazon API Gateway, AWS Lambda, AWS CloudTrail, and many others. These logs can be enabled directly in the services and CloudWatch. Posture management: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-posture-management
- Azure Active Directory logs: Logs of the history of sign-in activity and audit trail of changes made in the Azure Active Directory for a particular tenant. - Custom logs: Logs from your own application and on-premises resources. You may need to collect these logs by installing CloudWatch Agent in your operating systems and forward them to CloudWatch. https://aws.amazon.com/cloudwatch/features/
Enable and configure antimalware monitoring: Application Security and DevOps: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops
You can also use Microsoft Defender for Cloud and Azure Policy to enable resource logs and log data collecting on Azure resources. https://docs.microsoft.com/azure/security/fundamentals/antimalware#enable-and-configure-antimalware-monitoring-using-powershell-cmdlets While many services publish logs only to CloudWatch Logs, some AWS services can publish logs directly to AmazonS3 or Amazon Kinesis Data Firehose where you can use different logging storage and retention policies.
Threat intelligence: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-threat-intelligence
Operating systems and application logs inside in your compute resources:
https://docs.microsoft.com/azure/azure-monitor/agents/data-sources#operating-system-guest
LT-4 Logging and threat detection 6.2 - Activate Audit Logging 8.2 - Collect Audit Logs AU-3: CONTENT OF AUDIT RECORDS 10.8 Enable network logging for security investigation Enable logging for your network services to support network-related incident investigations, threat hunting, and security alert generation. The network logs may include logs from network services such as IP filtering, network and application firewall, DNS, flow monitoring and so on. Enable and collect network security group (NSG) resource logs, NSG flow logs, Azure Firewall logs, and Web Application Firewall (WAF) logs, and logs from virtual machines via the network traffic data collection agent for security analysis to support incident investigations, and security alert generation. You can send the flow logs to an Azure Monitor Log Analytics workspace and then use Traffic Analytics to provide insights. How to enable network security group flow logs: Enable and collect network logs such as VPC Flow Logs, WAF Logs, and Route53 Resolver query logs for security analysis to support incident investigations, and security alert generation. The logs can be exported to CloudWatch for monitoring or an S3 storage bucket for ingesting into the Microsoft Sentinel solution for centralized analytics. https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html nan Security operations: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-operations-center
6.3 - Enable Detailed Logging 8.5 - Collect Detailed Audit Logs AU-6: AUDIT REVIEW, ANALYSIS, AND REPORTING https://docs.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-portal
7.6 - Log All URL Requests 8.6 - Collect DNS Query Audit Logs AU-12: AUDIT GENERATION Collect DNS query logs to assist in correlating other network data. Infrastructure and endpoint security
8.7 - Enable DNS Query Logging 8.7 - Collect URL Request Audit Logs SI-4: INFORMATION SYSTEM MONITORING Azure Firewall logs and metrics:
12.8 - Deploy NetFlow Collection on Networking Boundary Devices 13.6 - Collect Network Traffic Flow Logs https://docs.microsoft.com/azure/firewall/logs-and-metrics Application security and DevOps: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops
Azure networking monitoring solutions in Azure Monitor: Threat intelligence: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-threat-intelligence
https://docs.microsoft.com/azure/azure-monitor/insights/azure-networking-analytics
Gather insights about your DNS infrastructure with the DNS Analytics solution:
https://docs.microsoft.com/azure/azure-monitor/insights/dns-analytics
LT-5 Logging and threat detection 6.5 - Central Log Management 8.9 - Centralize Audit Logs AU-3: CONTENT OF AUDIT RECORDS nan Centralize security log management and analysis Centralize logging storage and analysis to enable correlation across log data. For each log source, ensure that you have assigned a data owner, access guidance, storage location, what tools are used to process and access the data, and data retention requirements. Ensure that you are integrating Azure activity logs into a centralized Log Analytics workspace. Use Azure Monitor to query and perform analytics and create alert rules using the logs aggregated from Azure services, endpoint devices, network resources, and other security systems. How to collect platform logs and metrics with Azure Monitor: Ensure that you are integrating your AWS logs into a centralized resource for storage and analysis. Use CloudWatch to query and perform analytics, and to create alert rules using the logs aggregated from AWS services, services, endpoint devices, network resources, and other security systems. Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data: nan Security architecture: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-architecture
6.6 - Deploy SIEM or Log Analytic tool 8.11 - Conduct Audit Log Reviews AU-6: AUDIT REVIEW, ANALYSIS, AND REPORTING https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings https://docs.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3
6.7 - Regularly Review Logs 13.1 - Centralize Security Event Alerting AU-12: AUDIT GENERATION Use Cloud native SIEM if you don't have an existing SIEM solution for CSPs. or aggregate logs/alerts into your existing SIEM. In addition, enable and onboard data to Microsoft Sentinel which provides security information event management (SIEM) and security orchestration automated response (SOAR) capabilities. In addition, you can aggregate the logs in a S3 storage bucket and onboard the log data to Microsoft Sentinel which provides security information event management (SIEM) and security orchestration automated response (SOAR) capabilities. Application Security and DevOps: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops
8.6 - Centralize Anti-Malware Logging SI-4: INFORMATION SYSTEM MONITORING How to onboard Azure Sentinel:
https://docs.microsoft.com/azure/sentinel/quickstart-onboard Infrastructure and endpoint security: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-infrastructure-endpoint
LT-6 Logging and threat detection 6.4 - Ensure Adequate Storage for Logs 8.3 - Ensure Adequate Audit Log Storage AU-11: AUDIT RECORD RETENTION 10.5 Configure log storage retention Plan your log retention strategy according to your compliance, regulation, and business requirements. Configure the log retention policy at the individual logging services to ensure the logs are archived appropriately. Logs such as Azure Activity Logs are retained for 90 days and then deleted. You should create a diagnostic setting and route the logs to another location (such as Azure Monitor Log Analytics workspace, Event Hubs or Azure Storage) based on your needs. This strategy also applies to other resource logs and resources managed by yourself such as logs in the operating systems and applications inside VMs. Change the data retention period in Log Analytics: By default, logs are kept indefinitely and never expire in CloudWatch. You can adjust the retention policy for each log group, keeping the indefinite retention, or choosing a retention period between 10 years and one day. Altering CloudWatch log retention: nan Security architecture: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-architecture
8.10 - Retain Audit Logs 10.7 https://docs.microsoft.com/azure/azure-monitor/platform/manage-cost-storage#change-the-data-retention-period https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html
You have the log retention option as below: Use Amazon S3 for log archival from CloudWatch and apply object lifecycle management and archival policy to the bucket. You can use Azure Storage for central log archival by transferring the files from Amazon S3 to Azure Storage. Application Security and DevOps: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops
- Use Azure Monitor Log Analytics workspace for a log retention period of up to 1 year or per your response team requirements. How to configure retention policy for Azure Storage account logs: Copy data from Amazon S3 to Azure Storage by using AzCopy:
- Use Azure Storage, Data Explorer or Data Lake for long-term and archival storage for greater than 1 year and to meet your security compliance requirements. https://docs.microsoft.com/azure/storage/common/storage-monitor-storage-account#configure-logging https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-s3 Security operations: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-operations-center
- Use Azure Event Hubs to forward logs to an external resource outside of Azure.
Microsoft Defender for Cloud alerts and recommendations export: https://docs.microsoft.com/azure/security-center/continuous-export Security compliance management: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-compliance-management
Note: Microsoft Sentinel uses Log Analytics workspace as its backend for log storage. You should consider a long-term storage strategy if you plan to retain SIEM logs for longer time.
LT-7 Logging and threat detection 6.1 - Utilize Three Synchronized Time Sources 8.4 - Standardize Time Synchronization AU-8: TIME STAMPS 10.4 Use approved time synchronization sources Use approved time synchronization sources for your logging time stamp which include date, time and time zone information. Microsoft maintains time sources for most Azure PaaS and SaaS services. For your compute resources operating systems, use a Microsoft default NTP server for time synchronization unless you have a specific requirement. If you need to stand up your own network time protocol (NTP) server, ensure you secure the UDP service port 123. How to configure time synchronization for Azure Windows compute resources: AWS maintains time sources for most AWS services. For resources or services where the operating system time setting is configured, use AWS default Amazon Time Sync Service for time synchronization unless you have a specific requirement. If you need to stand up your own network time protocol (NTP) server, ensure you secure the UDP service port 123. Set the time for a Linux instance: nan Policy and standards: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-policy-standards
https://docs.microsoft.com/azure/virtual-machines/windows/time-sync https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html
All logs generated by resources within Azure provide time stamps with the time zone specified by default. All logs generated by resources within AWS provide time stamps with the time zone specified by default. Application Security and DevOps: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops
How to configure time synchronization for Azure Linux compute resources: Set the time for a Windows instance:
https://docs.microsoft.com/azure/virtual-machines/linux/time-sync https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-set-time.html Infrastructure and endpoint security: https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-infrastructure-endpoint
How to disable inbound UDP for Azure services:
https://support.microsoft.com/help/4558520/how-to-disable-inbound-udp-for-azure-services