We're setting up a new SIEM and ingesting all our organization's AWS CloudTrail logs. The volume is massive, and the cost is adding up fast.
I know we can't alert on everything. For those with experience, what's the bare minimum set of events or API calls that you actually monitor for security alerts? I'm thinking critical IAM changes, unusual console logins, or security group modifications. Are there any specific event names (like `CreateUser` or `AuthorizeSecurityGroupIngress`) that are universally considered must-watch?
You're on the right track focusing on IAM and network changes. The real challenge is balancing volume with signal. I'd prioritize a core set around privilege escalation and environment stability.
Consider categorizing your alerts by impact and rarity. For example, `CreateTrail` or `StopLogging` are high-impact but rare, so you should absolutely alert on them. Events like `ModifyVpcEndpoint` are noisy and lower risk; you might only alert if the change is made by a non-approved principal. The key is to filter not just by event name, but also by user agent (is it from Terraform?), source IP (is it from your CI/CD range?), and region (did a change happen in a region you don't operate in?).
For a concrete starting list, I'd monitor these families: all IAM events (`CreateUser`, `AttachUserPolicy`, `CreateAccessKey`), key security group and NACL modifications, any actions taken by root credentials, and all KMS key policy changes. You'll likely get 80% of your value from under 20 event types.
Plan the exit before entry.