Chapter 1 of 6 · AWS SCS-C03
Detection
Alerting with CloudWatch, EventBridge, GuardDuty and Security Hub, logging design and pipeline troubleshooting.
- 7topics
- 37 minfast track
- 2diagrams and exhibits
- 16%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1CloudWatch Alarms and Metric FiltersTurn log events into security alarms with CloudWatch metric filters, metric alarms and composite alarms, and know how missing…5 min
- 2EventBridge Alerting PipelinesBuild event driven security alerting with EventBridge rules, event patterns, cross account event buses and SNS or chat…Diagram6 min
- 3GuardDuty and DetectiveLearn how GuardDuty finds threats from CloudTrail, flow and DNS data, its protection plans, organization setup and how Detective…5 min
- 4Security Hub, Inspector and MacieCompare Security Hub, Amazon Inspector and Amazon Macie, and learn how to aggregate findings from many accounts and Regions into…5 min
- 5CloudTrail Logging DesignDesign AWS CloudTrail logging with organization trails, event types, log file validation, KMS encryption, protected S3 buckets…Diagram6 min
- 6Network and Service LogsChoose and set up VPC Flow Logs, Resolver query logs, load balancer, S3, WAF and CloudFront logs, and centralise them with Athena…5 min
- 7Troubleshooting Detection PipelinesFind out why CloudTrail, CloudWatch, EventBridge, GuardDuty and Security Hub pipelines stay silent, with a symptom to cause…5 min
About this chapter
What this chapter covers
Detection is about knowing what is happening in your AWS accounts and being told when something is wrong.
It has three parts that follow the exam outline.
The first is monitoring and alerting, which means choosing the right detection service and routing its output to people or automation. The second is logging, which means deciding what to record, where to keep it and how to protect it. The third is troubleshooting, which means finding out why a pipeline went silent.
The chapter follows the Detection domain of the AWS Certified Security Specialty SCS-C03 exam. Seven pages cover its three outline topics.
How the topics fit together
Logs are the raw material, detection services analyse them, and alerting carries the result to a person or a response.
- CloudWatch turns log content into metrics and alarms.
- EventBridge routes events and findings, including across accounts.
- GuardDuty, Detective, Inspector, Macie and Security Hub find threats, weaknesses and sensitive data, and gather the results.
- CloudTrail and the network logs are the evidence trail, kept in a protected central place.
- Troubleshooting walks the pipeline from source to person.
Most questions here are about choosing the least effort service that fits the signal, so ask first whether the signal is a metric, an event, a log or a finding.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
If you have an AWS account, build the root account alarm from the first page and trace one event through EventBridge to SNS. Doing it once makes the troubleshooting page much easier to follow.
Ready for more practice?
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.