Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-storage-6-12The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-aws-storage-6.12 |
| description | Ensure CloudWatch Metrics for AWS EDR |
| category | cis-storage-services |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","edr","cloudwatch","monitoring","metrics","logging","alerting"] |
| cis_id | 6.12 |
| cis_benchmark | CIS AWS Storage Services Benchmark v1.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-storage-6.9","cis-aws-storage-6.13"] |
| prerequisites | [] |
| severity_boost | {} |
Set up and monitor AWS CloudWatch metrics for Endpoint Detection and Response (EDR) to track and analyze the performance and security of your AWS environment. This involves configuring CloudWatch to collect detailed logs and metrics on EDR activities, such as threat detections, response actions, and system health. Regularly review these metrics to identify trends, anomalies, and potential security issues, enabling proactive management and timely responses to ensure the effectiveness of your EDR solution.
Implementing AWS CloudWatch metrics for Endpoint Detection and Response (EDR) is essential for maintaining a secure and efficient AWS environment. By collecting detailed logs and metrics on EDR activities, you gain valuable insights into the performance and health of your security measures. Regular review of these metrics allows for the early detection of trends, anomalies, and potential security threats, enabling proactive management and swift responses to maintain the integrity and effectiveness of your EDR solution. This continuous monitoring ensures that your security posture remains robust and adaptive to evolving threats.
CloudWatch monitoring provides:
Requirements:
Sign in to the AWS Management Console:
Navigate to CloudWatch:
Create a CloudWatch Log Group:
Configure AWS EDR to Send Logs to CloudWatch:
Set Up CloudWatch Alarms:
Create CloudWatch Dashboards:
Enable CloudWatch Logs Insights:
Set Up CloudWatch Events:
Create Log Group:
Configure EDR Logging:
Set Up Alarms:
Create Dashboards:
Enable Logs Insights:
Configure Events:
Test and Verify:
By default, CloudWatch metrics for AWS EDR are not configured. Organizations must manually set up log groups, metrics, alarms, dashboards, and event rules.
This control supports monitoring and logging best practices but does not directly map to specific CIS Controls v7/v8 items. It enables compliance with multiple controls related to logging, monitoring, and incident response.
