# 应用CloudTrail实现告警通知常见场景

首先，需要确保账号中[创建跟踪](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html)，[启用日志文件完整性验证](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html)。并且[确保 CloudTrail 跟踪与亚马逊 CloudWatch 日志集成](https://docs.amazonaws.cn/securityhub/latest/userguide/securityhub-cis-controls.html#securityhub-cis-controls-2.4)。

然后按需添加以下告警：

* [API未授权访问告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/api-wei-shou-quan-fang-wen-gao-jing-tong-zhi)
* [安全组更改告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/an-quan-zu-geng-gai-gao-jing-tong-zhi)
* [NACL更改告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/nacl-geng-gai-gao-jing-tong-zhi)
* [IGW更改告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/igw-geng-gai-gao-jing-tong-zhi)
* [路由表更改告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/lu-you-biao-geng-gai-gao-jing-tong-zhi)
* [VPC更改告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/vpc-geng-gai-gao-jing-tong-zhi)
* [没有通过MFA登录时的告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/mei-you-tong-guo-mfa-deng-lu-shi-de-gao-jing-tong-zhi)
* [根用户使用时的告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/gen-yong-hu-shi-yong-shi-de-gao-jing-tong-zhi)
* [IAM策略变更告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/iam-ce-le-bian-geng-gao-jing-tong-zhi)
* [AWS控制台登录失败告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/aws-kong-zhi-tai-deng-lu-shi-bai-gao-jing-tong-zhi)
* [禁用或计划删除客户管理密钥告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/jin-yong-huo-ji-hua-shan-chu-ke-hu-guan-li-mi-yao-gao-jing-tong-zhi)
* [更改S3 Bucket Policy告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/geng-gai-s3-bucket-policy-gao-jing-tong-zhi)
* [更改Amazon Config告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/geng-gai-amazon-config-gao-jing-tong-zhi)
* [AWS Personal Health Dashboard告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/aws-personal-health-dashboard-gao-jing-tong-zhi)
* [CloudTrail配置变更告警通知](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/gao-jing-tong-zhi-she-zhi/ying-yong-cloudtrail-shi-xian-gao-jing-tong-zhi-chang-jian-chang-jing/cloudtrail-pei-zhi-bian-geng-gao-jing-tong-zhi)
