Your First AWS SOC Workflow: Detecting Suspicious Activity with CloudTrail and GuardDuty
Security operations on AWS can look overwhelming, with hundreds of services and endless logs. A beginner doesn’t need all of them. Two services cover most first-day detection: CloudTrail records what happened, and GuardDuty flags what looks wrong. This article walks thro
AWS SOC workflow from CloudTrail and GuardDuty through triage and investigation to containment.
The flow at a glance: CloudTrail → GuardDuty → Triage → Investigate → Contain. The first two steps collect data, the next two analyze it, and the last one responds.
Step 1: Turn on the record (CloudTrail)
- CloudTrail logs API activity: who did what, from where, and when.
- Event history shows recent management events with no setup. For longer-term records, create a trail that delivers to an S3 bucket.
- Enable it in all regions. Attackers often work in regions you never use.
- Output: a searchable history of API calls.
Step 2: Turn on detection (GuardDuty)
- GuardDuty analyzes CloudTrail, VPC flow, and DNS logs and raises findings for suspicious behavior.
- Enable it in one click and use the trial period to learn it. Check the pricing page before leaving it on.
- Use “generate sample findings” to practice triage without a real attack.
- Output: a list of findings to review.
Step 3: Triage a finding
Open a finding and answer four questions:
- What happened? Read the finding type and description.
- Who or what did it? Note the IAM user, role, or instance.
- Where did it come from? Check the source IP and region.
- How severe is it? Severity tells you what to handle first.
Output: a ranked alert you understand.
Step 4: Investigate in CloudTrail
- Search the same user or access key over the same time window.
- Look for the usual attacker steps: new access keys created, new users or policies added, logging turned off, security groups opened to 0.0.0.0/0.
- Decide whether it’s expected activity or a real problem.
- Output: a clear timeline of events.
Step 5: Contain and learn
- Disable the exposed access key or restrict the role.
- Isolate the affected instance with a restrictive security group.
- Rotate credentials and write down what you found.
- Output: a short runbook for next time.
Weekly beginner checks
- Is MFA on for every user, especially root?
- Are there unused access keys?
- Is any storage bucket public?
- Is CloudTrail still on?
Conclusion
You don’t need an enterprise setup to learn detection and response. CloudTrail plus GuardDuty gives you a real alert, a real investigation trail, and a repeatable process. Practice with sample findings, build a runbook, and you already have the habits of a junior SOC analyst.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article