KSI-IAM-SUSResponding to Suspicious Activity

The mark says whether an authored AWS recipe fetches evidence for the control; the tier strip shows which Rev5 baselines also require it — where automated KSI evidence doubles as Rev5 control evidence. ▪▪▫ = in the class B, C and D baselines, left to right

• ●recipe— an authored recipe collects evidence for this control
• ◐KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
• ○orphan— no Key Security Indicator reaches it — a person writes it up instead

• ●recipe · 1 recipeAC-02AC▪▪▪In baseline B, C, D
• ◐KSI onlyAC-02 (01)AC▫▪▪In baseline C, D
• ●recipe · 1 recipeAC-02 (03)AC▫▪▪In baseline C, D
• ●recipe · 1 recipeAC-02 (13)AC▫▪▪In baseline C, D
• ●recipe · 1 recipeAC-07AC▪▪▪In baseline B, C, D
• ●recipe · 1 recipePS-04PS▪▪▪In baseline B, C, D
• ◐KSI onlyPS-08PS▪▪▪In baseline B, C, D

Collect evidence (1)

Authored AWS recipes whose output is evidence for KSI-IAM-SUS. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

• ◐partialGuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principalcontinuouscli
  guardduty-suspicious-iam-activity-responseGuardDuty · CloudTrail · IAM

  Detection is pure telemetry; the response (which key/user to disable, whether it was malicious vs. authorized) requires incident-responder judgement, so this is partial. Evidence = finding + a linked responsive CloudTrail event within the IR SLA. cloudtrail lookup-events covers the last 90 days; use the finding type relevant to your workload.

Default evidence owed by every indicator (5)

From info.default_artifacts.KSI — no indicator carries its own artifacts; requirement-specific evidence lives on /evidence.

• Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.
• Explanation of the cycle for any measures that are implemented persistently (if applicable).
• Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.
• Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.
• Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid.

Defined terms used (1)

Vulnerability Response

The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities.

• ●3 authored recipesKSI-IAM-AAMAutomating Account Management
• ●5 authored recipesKSI-IAM-APMAdopting Passwordless Methods
• ●11 authored recipesKSI-IAM-ELPEnsuring Least Privilege
• ●4 authored recipesKSI-IAM-JITAuthorizing Just-in-Time
• ●2 authored recipesKSI-IAM-SNUSecuring Non-User Authentication
• ●1 authored recipeKSI-IAM-SUSResponding to Suspicious Activityyou are here