Internship← Cloud Security learning pathCloud Security · Module 6 of 10
Logging, monitoring and detection
See what happens in your cloud.
📖 Key ideas
- Enable audit logs: AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs.
- Centralise logs and set retention.
- Threat detection: GuardDuty, Defender for Cloud, Security Command Center.
- Alert on risky events: root login, policy changes, public buckets.
- Feed logs to a SIEM for correlation.
💡 Real-life example: Cloud logging is CCTV for every door; detection services are guards watching the screens.
Audit logRecord of API/admin actions
Threat detectionAutomated suspicious activity alerts
RetentionHow long logs are kept
SIEMSecurity event correlation system