3 ms·
They're ingesting several data sources, including CloudTrail (IAM events in the account) and VPC flow logs (network activity) to look for suspicious behavior. F
by cddotdotslash 9y ago
They're ingesting several data sources, including CloudTrail (IAM events in the account) and VPC flow logs (network activity) to look for suspicious behavior. For example, if someone disables CloudTrail logging, that API event is suspicious, especially if it comes from outside your organization. If your EC2 instances start pinging known Bitcoin mining servers, that's probably something you want to fix as well.