Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-database-4-7The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-aws-database-4.7 |
| description | Ensure Monitor and Audit Activity is enabled |
| category | cis-database |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","database","dynamodb","monitoring","cloudtrail","cloudwatch","audit"] |
| cis_id | 4.7 |
| cis_benchmark | CIS AWS Database Services Benchmark v2.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-database-4.6"] |
| prerequisites | [] |
| severity_boost | {} |
Regular monitoring and auditing of activity in Amazon DynamoDB help ensure your database's security, performance, and compliance.
This keeps track and ensures who has recently modified a document and monitors all activity within the database. This information allows the individual to use the details provided for auditing purposes and to address any compliance requirements.
N/A
Enable CloudTrail Logging for DynamoDB
Trails from the left-side menu.Create trail or select an existing trail.Data events, select the checkbox for DynamoDB to enable logging of DynamoDB data events.Create trail or Save changes to save the CloudTrail configuration.Enable DynamoDB Streams
Overview tab.DynamoDB Streams section, click Manage stream.New and old images).Enable.Configure Amazon CloudWatch Alarms
Alarms.Create alarm.Create alarm to save the configuration.Analyze and Review Logs and Metrics
Logs to access CloudWatch Logs./aws/dynamodb/TableName).Metrics in the left-side menu.Enable AWS Config for DynamoDB
Rules in the left-side menu.Add rule.Save to create the AWS Config rule.CloudTrail logging is enabled for DynamoDB data events, DynamoDB Streams are enabled, CloudWatch alarms are configured, and AWS Config rules are in place for compliance monitoring.
Follow the same steps as the audit procedure to enable monitoring and auditing for DynamoDB.
By default, CloudTrail logs management events but not DynamoDB data events. DynamoDB Streams are disabled by default.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.1 Establish and Maintain an Audit Log Management Process | x | x | x |
| v7 | 6.2 Activate audit logging | x | x | x |
Level 1 | Manual