Sunturai
Back to results
MediumSplunk security contentMaria Jose Erquiaga +1

AWS Repeated CloudWatch Logs Read Operations

The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a five-minute period. It identifies more than 500 DescribeLogGroups,…

Description

The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a five-minute period. It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.

Detection logic

Detection requirements

Platform
IaaSOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
aws_cloudtrail

Known benign triggers

  • Automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read CloudWatch Logs and generate a high volume of matching operations. The prevalence of this activity has not yet been evaluated against broader customer telemetry. Review the principal, account, source addresses, user agents, Regions, and accessed CloudWatch Logs resources before escalating.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice