Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
60
Curated Reports
2077+
Controls Checked
3
Cloud Providers
5 min
To First Results
Logging Best Practices
35 controls
11 services covered
Evaluates logging operations and retention — CloudWatch log retention and enhanced monitoring, deployment alarms and alarm actions, RDS and MSK monitoring, CodeDeploy alarms, and AWS Config failed-delivery signals.
What we check
CloudWatch Metric Filter Alarms15
- Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- Ensure a log metric filter and alarm exist for AWS Config configuration changes
- Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
- Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created KMS CMKs
- Ensure a log metric filter and alarm exist for IAM policy changes
- Ensure a log metric filter and alarm exist for changes to Network Access Control Lists
- Ensure a log metric filter and alarm exist for changes to network gateways
- Ensure a log metric filter and alarm exist for changes to AWS Organizations
- Ensure a log metric filter and alarm exist for usage of root account
- Ensure a log metric filter and alarm exist for route table changes
- Ensure a log metric filter and alarm exist for S3 bucket policy changes
- Ensure a log metric filter and alarm exist for security group changes
- Ensure a log metric filter and alarm exist for unauthorized API calls
- Ensure a log metric filter and alarm exist for VPC changes
EventBridge Finding Alert Rules8
- Real-Time Alerts Configured for GuardDuty Findings
- Real-Time Alerts Configured for Inspector Findings
- Real-Time Alerts Configured for Macie Findings
- Real-Time Alerts Configured for AWS Security Hub Findings
- Real-Time Alerts Configured for IAM Access Analyzer Findings
- Real-Time Alerts Configured for Config Compliance Events
- Real-Time Alerts Configured for AWS Health Events
- Real-Time Alerts Configured for Trusted Advisor Findings
CloudWatch Alarms2
- CloudWatch Log Groups Retention Policy Configured
- CloudWatch Alarm Action is Configured
Config Recorders2
- Config configuration recorder should not fail to deliver logs
- Config recorders cover all resource types
Security Lake Data Lakes2
- Security Lake Data Lake Lifecycle Configured
- Security Lake CloudTrail Management Source Enabled
Elastic Beanstalk Environments1
- Elastic Beanstalk Logs to CloudWatch Retention Settings Check
RDS DB Instances1
- RDS Enhanced Monitoring Enabled
MSK Clusters1
- MSK Enhanced Monitoring Enabled Check
CodeDeploy Deployment Groups1
- CodeDeploy Monitoring Configuration Check
CloudWatch Log Groups1
- Audit Log Groups Have Deletion Protection
CloudWatch Cross-Account Sharing1
- CloudWatch Cross-Account Sharing Is Restricted
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.