Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
60
Curated Reports
2077+
Controls Checked
3
Cloud Providers
5 min
To First Results
Detection & Response Best Practices
68 controls
28 services covered
Checks threat detection and response — GuardDuty, Security Hub, Inspector, and Macie enablement and delegated administration, AWS Config, finding aggregation, and real-time alerting through CloudWatch event rules, metric filters, and alarm actions.
What we check
CloudWatch Metric Filter Alarms15
- Ensure a log metric filter and alarm exist for usage of root account
- Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
- Ensure a log metric filter and alarm exist for IAM policy changes
- Ensure a log metric filter and alarm exist for unauthorized API calls
- Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- Ensure a log metric filter and alarm exist for AWS Config configuration changes
- Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs
- Ensure a log metric filter and alarm exist for changes to Network Access Control Lists
- Ensure a log metric filter and alarm exist for changes to network gateways
- Ensure a log metric filter and alarm exist for changes to AWS Organizations
- Ensure a log metric filter and alarm exist for route table changes
- Ensure a log metric filter and alarm exist for S3 bucket policy changes
- Ensure a log metric filter and alarm exist for security group changes
- Ensure a log metric filter and alarm exist for VPC changes
EventBridge Finding Alert Rules8
- Real-Time Alerts Configured for GuardDuty Findings
- Real-Time Alerts Configured for Inspector Findings
- Real-Time Alerts Configured for Macie Findings
- Real-Time Alerts Configured for AWS Security Hub Findings
- Real-Time Alerts Configured for Config Compliance Events
- Real-Time Alerts Configured for IAM Access Analyzer Findings
- Real-Time Alerts Configured for AWS Health Events
- Real-Time Alerts Configured for Trusted Advisor Findings
Security Hub Organization Settings5
- Security Hub Findings Aggregated to Dedicated Security Account
- Security Hub Finding Cross-Region Aggregation is Configured
- Security Hub Auto-Enroll Accounts in the Organization
- Security Hub Auto-Enable New Controls Configured
- Security Hub Management is Delegated in the Organization
Inspector Lambda Scanning4
- Amazon Inspector Lambda Standard Scanning is Enabled
- Inspector Lambda Code Scanning Enabled
- Lambda Functions Covered by Inspector Vulnerability Scanning
- No active Inspector Findings for Lambda Functions
GuardDuty Organization Settings3
- GuardDuty Security Findings are Aggregated to a Dedicated Account
- GuardDuty Auto-Enroll Accounts in the Organization
- GuardDuty Management is Delegated in the Organization
Security Hub Settings3
- AWS Security Hub is Enabled
- AWS Security Best Practices Monitoring Enabled
- Security Hub AI Security Best Practices Enabled
Inspector EC2 Scanning3
- Inspector Scanning Enabled for EC2
- EC2 Instances Covered by Inspector Vulnerability Scanning
- No Active Inspector Findings for EC2 Instances
Inspector ECR Scanning3
- Inspector Scanning Enabled for ECR
- ECR Repositories Covered by Inspector Vulnerability Scanning
- No active Inspector Findings for ECR Repositories
GuardDuty S3 Protection2
- GuardDuty S3 Protection Enabled
- GuardDuty S3 Protection Auto-Enroll Accounts in the Organization
Macie Organization Settings2
- Macie Auto-Enroll Accounts in the Organization
- Macie Findings are Aggregated to a Dedicated Account
Config Recorders2
- Config configuration recorder should not fail to deliver logs
- Config recorders cover all resource types
Shield Advanced2
- Shield Advanced Proactive Engagement Enabled
- Shield Advanced SRT Access Configured
GuardDuty Settings1
- Amazon GuardDuty is Enabled
GuardDuty Findings1
- No Active GuardDuty Findings
GuardDuty EC2 Malware Protection1
- GuardDuty EC2 Malware Protection Enabled
GuardDuty Runtime Protection1
- GuardDuty Runtime Protection Enabled
GuardDuty Lambda Protection1
- GuardDuty Lambda Protection Enabled
GuardDuty RDS Protection1
- GuardDuty RDS Login Events Protection Enabled
Security Hub Findings1
- No Active Security Hub Findings
Macie Settings1
- Amazon Macie Enabled
Macie Findings1
- Amazon Macie Active Findings
CloudWatch Alarms1
- CloudWatch Alarm Action is Configured
AWS Config Settings1
- AWS Config should be enabled and use the service-linked role for resource recording
GuardDuty AI Protection1
- GuardDuty AI Protection Enabled Where AI Resources Exist
GuardDuty Malware Protection for AWS Backup1
- AWS Backup Automatic Malware Scanning Enabled
IoT Device Defender Audit1
- IoT Certificate Lifecycle Auditing Enabled
Detective Settings1
- Detective Behavior Graph Members Enabled
Detective Organization Settings1
- Detective Organization Auto Enable
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.