Alert Pack: AWS Essential Alerts

[ 1 Purpose ] [ 2 Prerequisites ] [ 3 Open alert pack ] [ 4 Use alert pack ]

Purpose

The alert pack AWS Essential Alerts consists of Devo Platform’s most popular alerts. There are 20 alerts that are primarily focused on the analysis of CloudTrail events. It allows you to monitor, in a very fast way, the security and compliance levels of your AWS operations.

Security Operations application SecOps users can obtain detailed information if they install these alerts using the Content Manager instead.
AWSWAFRuleDeletion	AWSS3PoliciesChange	AWSCreatedACL
AWSRootAccessConsoleLogin	AWSEC2GroupPoliciesChange	AWSModifiedRouteTables
AWSRootAccessConsoleLoginNoMFA	AWSIAMResourceChange	AWSEBSEncryptionDisabled
AWSRootConsoleLoginFailure	AWSCloudTrailLoggingChange	AWSEC2LogsDisabled
AWSConsoleLogin	AWSCloudWatchLoggingChange	AWSGuardDutyDetectorDisabled
AWSConsoleLoginNoMFA	AWSSecretsRetrievalAttempt	AWSCloudWatchAlarmsDeletion
AWSConsoleLoginFailure	AWSDeletedACL

Prerequisites

To use the alert pack, you must have the following data sources available on your domain:

cloud.aws.cloudtrail ^{learn more}

Open alert pack

Once you have installed the alert pack, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find it and later manage it as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).

Use alert pack

The alerts in the alert pack are deactivated by default when the alert pack is installed. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.