| description | Cloud audit, identity, activity, and flow logging |
|---|
Cloud logging should capture identity activity, control-plane API calls, workload/network activity, security findings, and SaaS audit records. Keep posture management, hardening, and offensive cloud testing on the main Cloud page.
{% content-ref url="../cloud.md" %} cloud.md {% endcontent-ref %}
- Microsoft Purview: Search the audit log
- Office 365 Management Activity API schema
- Enable Unified Audit Log for delegated Microsoft 365 tenants
- Everything you wanted to know about security and audit logging in Office 365
- Microsoft-365-Extractor-Suite - Collection tooling for Microsoft 365 investigation and audit data.
- Unified Audit Logs in Microsoft 365
- The basics of modern authentication - Microsoft identity platform
- Azure Monitor Activity Log
- Azure diagnostic settings
- Microsoft Sentinel
- AWS CloudTrail - Control-plane API logging.
- AWS CloudTrail Lake - Queryable CloudTrail event lake.
- Amazon VPC Flow Logs - Network flow metadata for VPCs, subnets, and interfaces.
- Amazon GuardDuty - Managed threat detection findings.
- AWS Security Hub - Aggregates security findings and posture signals.
- AWS Config - Configuration history and compliance records.
- Cloud Audit Logs - Admin activity, data access, system event, and policy denied logs.
- VPC Flow Logs - Network flow metadata.
- Cloud Logging - Centralized logging platform.
- Security Command Center - Findings and cloud security posture signals.
- Centralize identity and control-plane logs first.
- Enable network flow logs where investigations require cloud east-west visibility.
- Normalize account, subscription, project, region, resource ID, principal, source IP, action, result, and user-agent fields.
- Export logs to durable storage when retention requirements exceed native platform defaults.
- Treat SaaS audit logs as first-class sources, especially for identity, mailbox, file-sharing, and administrative actions.