Networks and network services are monitored to detect adverse events

Implementation steps

1. 1

   Enable centralized logging for all critical systems

   Route logs from your cloud infrastructure, identity provider, and production services into a single destination. You need authentication events, admin actions, network flow data, and application errors in one searchable place.

   aws-cloudtraildatadogsplunkelasticgrafana-loki
2. 2

   Set up alerts for high-priority events

   Define alerts for: failed login spikes, successful logins from unexpected geographies, privilege escalation, new admin accounts, large data exports, and any change to security group or firewall rules.

   datadogpagerdutyopsgenieaws-guardduty
3. 3

   Define log retention policy

   Logs must be retained long enough to support incident investigations. 90 days hot (searchable) and 12 months cold (archived) is a common baseline that satisfies most compliance frameworks.

   aws-s3cloudflare-logpush
4. 4

   Test that alerts fire

   Run a tabletop exercise or deliberate test: trigger a failed login spike in a staging environment and verify the alert reaches the right person. Untested alerts are not alerts.

Evidence required