MLA — Monitoring, Logging, and Auditing
5 indicators, 28 controls in scope for class C; 19 of them have an authored recipe.
Class C vulnerability-response floor
VDR floor3 days
- tightest MUST
- 3 days — VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
A response floor, not a collection interval — why
This is a class-widefloor on responding to a vulnerability, quoted in the dataset’s own units and never converted. It is not a per-check collection interval — the rules author none. Schedule against the MUST; the tightest entry may be a SHOULD.
- automatable
- partial — needs judgement
- narrative — no API proves this
partialAWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloudtrail-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name multi-region-cloudtrail-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-encryption-enabled --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names cloudtrail-enabled$ aws configservice describe-config-rule-evaluation-status --config-rule-names multi-region-cloudtrail-enabled$ aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-log-file-validation-enabled$ aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-encryption-enabled$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textpartialAWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name guardduty-enabled-centralized --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name securityhub-enabled --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names guardduty-enabled-centralized$ aws configservice describe-config-rule-evaluation-status --config-rule-names securityhub-enabled$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textprovesKSI-MLA-RVLKSI-SVC-EIS→SI-04
partialAWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than drifting
continuouscli
$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-managed-by-systems-manager --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-association-compliance-status-check --compliance-types NON_COMPLIANT$ aws ssm list-associations --query 'Associations[].{Name:Name,AssociationId:AssociationId,Schedule:ScheduleExpression,Targets:Targets,Status:Overview.Status,LastRun:LastExecutionDate}'partialThe metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit review
weeklycli
$ aws logs describe-metric-filters --query 'metricFilters[].{Filter:filterName,LogGroup:logGroupName,Pattern:filterPattern,Metric:metricTransformations[0].metricName}'$ aws cloudwatch describe-alarms --alarm-types MetricAlarm CompositeAlarm --query 'MetricAlarms[].{Name:AlarmName,Metric:MetricName,State:StateValue,Actions:AlarmActions}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloudwatch-alarm-action-check --compliance-types NON_COMPLIANTprovesKSI-MLA-RVL→AU-06AU-06 (01)
partialHow long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fields
dailycli
$ aws logs describe-log-groups --query 'logGroups[].{Group:logGroupName,RetentionDays:retentionInDays,StoredBytes:storedBytes,Class:logGroupClass}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name cw-loggroup-retention-period-check --compliance-types NON_COMPLIANT$ aws s3api get-bucket-lifecycle-configuration --bucket <LOG_BUCKET>$ aws configservice get-compliance-details-by-config-rule --config-rule-name s3-lifecycle-policy-check --compliance-types NON_COMPLIANT$ aws cloudwatch get-metric-statistics --namespace AWS/S3 --metric-name BucketSizeBytes --dimensions Name=BucketName,Value=<LOG_BUCKET> Name=StorageType,Value=StandardStorage --start-time <START_TIME> --end-time <END_TIME> --period 86400 --statistics Average$ aws cloudtrail get-trail-status --name <TRAIL_NAME> --query '{Logging:IsLogging,LastDelivery:LatestDeliveryTime,DeliveryError:LatestDeliveryError,DigestDelivery:LatestDigestDeliveryTime,DigestError:LatestDigestDeliveryError,NotificationError:LatestNotificationError}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-cloud-watch-logs-enabled --compliance-types NON_COMPLIANTprovesKSI-MLA-OSM→AU-04AU-05AU-11
partialWhat each instance's clock is actually locked to and how far off it is right now — the chrony daemon's reference source, offset and leap status collected fleet-wide through Run Command — together with the configured time source in chrony.conf and the UTC time stamps CloudTrail already writes on every audit record
dailycli
$ aws ssm send-command --document-name AWS-RunShellScript --targets Key=tag:Environment,Values=<ENVIRONMENT_TAG> --parameters 'commands=["chronyc tracking","chronyc sources -v | grep -F ^*","grep -E \"^(server|pool|refclock)\" /etc/chrony.conf"]' --output-s3-bucket-name <EVIDENCE_BUCKET> --output-s3-key-prefix au-08$ aws ssm list-command-invocations --command-id 11111111-2222-3333-4444-555555555555 --details --query 'CommandInvocations[].{Instance:InstanceId,Status:Status,Output:CommandPlugins[].Output}'$ aws cloudtrail lookup-events --max-results 5 --query 'Events[].{Name:EventName,Time:EventTime,Source:EventSource}'provesKSI-MLA-OSM→AU-08
partialHow operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead
weeklycli
$ aws ssm get-document --name SSM-SessionManagerRunShell --document-version '$LATEST' --query Content --output text$ aws ssm describe-sessions --state History --query 'Sessions[].{owner:Owner,target:Target,start:StartDate,end:EndDate,document:DocumentName,accessType:AccessType,maxDuration:MaxSessionDuration}'$ aws ec2 describe-client-vpn-endpoints --query 'ClientVpnEndpoints[].{id:ClientVpnEndpointId,transport:TransportProtocol,auth:AuthenticationOptions[].Type,connectionLog:ConnectionLogOptions,splitTunnel:SplitTunnel,sessionTimeoutHours:SessionTimeoutHours,serverCert:ServerCertificateArn,selfServicePortal:SelfServicePortalUrl}'$ aws ec2 describe-client-vpn-connections --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --query 'Connections[].{user:Username,commonName:CommonName,clientIp:ClientIp,established:ConnectionEstablishedTime,ended:ConnectionEndTime,status:Status,posture:PostureComplianceStatuses}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-no-public-ip --compliance-types NON_COMPLIANTpartialA demonstration run against the live log estate that audit records can be reduced, sorted and searched on demand by event criteria — the standing saved queries, the query that ran, and the report it returned
quarterlycli
$ aws logs describe-query-definitions --query 'queryDefinitions[].{id:queryDefinitionId,name:name,language:queryLanguage,logGroups:logGroupNames}'$ aws logs start-query --log-group-names <LOG_GROUP_NAME> --start-time <START_EPOCH> --end-time <END_EPOCH> --query-string 'fields @timestamp, userIdentity.arn, eventName, sourceIPAddress | filter eventName = "ConsoleLogin" | sort @timestamp desc | limit 1000'$ aws logs get-query-results --query-id <QUERY_ID>$ aws cloudtrail list-event-data-stores --query 'EventDataStores[].{name:Name,arn:EventDataStoreArn,status:Status,retentionDays:RetentionPeriod,multiRegion:MultiRegionEnabled,organization:OrganizationEnabled,terminationProtection:TerminationProtectionEnabled}'$ aws cloudtrail start-query --query-statement "SELECT eventTime, eventName, userIdentity.arn, sourceIPAddress FROM <EVENT_DATA_STORE_ID> WHERE eventName = 'ConsoleLogin' ORDER BY eventTime DESC LIMIT 1000" --delivery-s3-uri s3://<EVIDENCE_BUCKET>$ aws athena start-query-execution --work-group primary --query-execution-context Database=cloudtrail_logs --result-configuration OutputLocation=s3://audit-reports-bucket/athena/ --query-string "SELECT eventtime, useridentity.arn, eventname, sourceipaddress FROM cloudtrail_logs WHERE eventname = 'ConsoleLogin' ORDER BY eventtime DESC LIMIT 1000"partialFor each artifact actually running in the boundary, the cryptographic answer to whether it came from the build this provider claims built it: the signed provenance statement, the certificate identifying the workflow that produced it, and the transparency-log timestamps that make the signature checkable later. Collected alongside the two things that decide whether that answer can be trusted at all — the version of the verifying client, and the record of which deployed artifacts were submitted for verification in the first place.
on-changecli
$ gh --version$ aws ecr describe-repositories --query "repositories[].repositoryName" --output json$ aws ecr describe-images --repository-name <ECR_REPO> --query "imageDetails[].{digest:imageDigest,pushedAt:imagePushedAt,tags:imageTags}" --output json$ gh attestation verify oci://<REGISTRY>/<IMAGE>@<DIGEST> --repo <ORG>/<REPO> --predicate-type https://slsa.dev/provenance/v1 --format json$ gh api "/repos/<ORG>/<REPO>/attestations/sha256:<DIGEST>?per_page=100"$ gh attestation trusted-root > trusted_root.jsonlprovesKSI-MLA-EVC→SI-07 (07)
Indicators in this theme
- KSI-MLA-ALA1 controlsAuthorizing Log Access
- KSI-MLA-EVC4 controlsEvaluating Configurations
The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested.
- KSI-MLA-LET10 controlsLogging Event Types
A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur.
- KSI-MLA-OSM18 controlsOperating SIEM Capability
A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.
- KSI-MLA-RVL7 controlsReviewing Logs
Logs are persistently reviewed and audited.
No accounts — your progress ticks never leave this browser.