AWS Security Alerts
Welcome to the CUIT Cybersecurity AWS
Critical
- AWS API Key Compromised
- Missing Account Owner Information
- Network ACLs - All Allowed Ingress/Egress, Any
- Public Buckets
- User Activity from Blacklisted Countries and Known Bad IP Addresses
High
- AWS Region Outside the US
- CloudTrail Started/Stopped
- Console Brute Force Detected
- Disabled or Scheduled Deletion of CMK
- Geographic Improbable Login
- High Volume of Lambda Activity Detected
- Login Bypassing SAML
- Malicious Activity Detected - Threat Intel
- Root Account Activity
- Security Group Changes
- Security Hub Changes
- Short Lived Accounts
- User Without MFA
- Web App Attack Detected Malicious UserAgent
Low
- Gateway Changes
- IAM Policy Changes
- Route Table Changes
- S3 Bucket Changes
- Security Group Change
- Unusual Instance Specifications and Types
- VPC Changes
Medium
, multiple selections available, Use left or right arrow keys to navigate selected items