Document toolboxDocument toolbox

Platform alert pack: AWS Essential Alerts

Purpose

The alert pack AWS Essential Alerts consists of Devo Platform’s most popular alerts. There are 20 alerts that are primarily focused on the analysis of CloudTrail events. It allows you to monitor, in a very fast way, the security and compliance levels of your AWS operations.

Included Alerts

AWSWAFRuleDeletion

AWSS3PoliciesChange

AWSCreatedACL

AWSRootAccessConsoleLogin

AWSEC2GroupPoliciesChange

AWSModifiedRouteTables

AWSRootAccessConsoleLoginNoMFA

AWSIAMResourceChange

AWSEBSEncryptionDisabled

AWSRootConsoleLoginFailure

AWSCloudTrailLoggingChange

AWSEC2LogsDisabled

AWSConsoleLogin

AWSCloudWatchLoggingChange

AWSGuardDutyDetectorDisabled

AWSConsoleLoginNoMFA

AWSSecretsRetrievalAttempt

AWSCloudWatchAlarmsDeletion

AWSConsoleLoginFailure

AWSDeletedACL

 

Prerequisites

To use the alert pack, you must have the following data sources available on your domain:

Open alert pack

Once you have installed the desired alerts individually, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find them and later manage them as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).

Platform alert packs (use alert pack).png

Use alert pack

The alerts installed are deactivated by default. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.