Implement Cloud Monitoring and Alerting Using SIEM Tools

You are a Cloud Security Analyst at CyberSecure Solutions. The organisation wants to monitor cloud activity and receive alerts when suspicious actions occur.

Your task is to connect cloud logs to a SIEM, monitor cloud events, create a basic alert rule, and verify that the alert is generated.

Topic: Cloud Monitoring and Visibility

1) Cloud Environment Visibility & Architecture

2) Cloud Logging & Monitoring

3) Threat Detection in Cloud Environments

Objective

Make cloud activity visible in the SIEM.

​

Log in to the authorized cloud account.

Enable the cloud provider's audit/activity logging.

Configure the logs to be collected by the SIEM.

Open the SIEM dashboard.

Verify that the cloud log source is connected.

Confirm that cloud events are being received.

Expected Output

Example

Cloud activity logs are visible in the SIEM.

Objective

Observe normal and security-related cloud activities.

Open the SIEM event dashboard.

Search for cloud events.

Monitor activities such as:

Record:

• User login

• Resource creation

• Resource modification

• Permission changes

• Resource deletion

• User

• Resource

• Action

• Timestamp

• Source IP

• Status

Expected Output

Students can monitor cloud activity from the SIEM.

Objective

Configure the SIEM to generate an alert for suspicious activity

Example Scenario

Alert when a privileged IAM permission is changed.

Open the SIEM detection/rule configuration.

Select the relevant cloud event.

Define the detection condition.

Set an appropriate severity.

Save the rule.

Expected Output

Test the rule using the authorised training environment.

Example

A cloud security alert rule is successfully configured.

Objective

Verify that the alert works correctly.

Use a test IAM account.

Verify that the SIEM generated an alert.

Record the alert details.

Open the SIEM dashboard.

Search for the event.

Perform the approved activity that matches the rule.

Expected Output

Objective

Analyse the cloud alert like a SOC analyst.

Open the generated alert.

Review:

• Username

• Source IP

• Resource

• Action

• Timestamp

• Severity

Check related cloud events

Determine whether the activity is:

• Normal

• Suspicious

• Potential Incident

Expected Output

Students complete a basic cloud-alert investigation.

Objective

Respond to suspicious cloud activity.

If the activity is considered suspicious in the training scenario:

Disable the test account, or

Remove unnecessary permissions, or

Revert the unauthorized configuration.

Continue monitoring the SIEM.

Verify that the suspicious activity has stopped.

Expected Output

Objective

Create a basic cloud security alert report.

Record:

Students demonstrate a basic detect → investigate → respond workflow.

Example Finding

Alert: Unauthorised IAM Permission Change

Detection:

The SIEM generated an alert when a privileged permission

was changed on a test IAM account.

Investigation:

The user, source IP, timestamp and affected resource

were reviewed.

Response:

The unauthorized permission was removed.

Status:

Incident resolved.

Example Finding

Alert: Unauthorised IAM Permission Change

Detection:

The SIEM generated an alert when a privileged permission

was changed on a test IAM account.

Investigation:

The user, source IP, timestamp and affected resource

were reviewed.

Response:

The unauthorized permission was removed.

Status:

Incident resolved.

Expected Output

Click Here for the Output

Great job!

After completing this lab, students will be able to understand cloud monitoring, integrate cloud logs with a SIEM, monitor cloud activities, create basic alert rules, detect suspicious cloud events, investigate cloud security alerts, apply basic defensive measures, and document cloud incidents effectively.

Topic: Cloud Monitoring and Visibility

1) Cloud Environment Visibility & Architecture

2) Cloud Logging & Monitoring

3) Threat Detection in Cloud Environments