Amazon CloudWatch is AWS's centralized monitoring and observability service that collects metrics, logs, and events from AWS resources and applications, enabling dashboards, alarms, and automated responses.
Overview
Amazon CloudWatch is AWS's centralized monitoring and observability service that collects metrics, logs, and events from AWS resources and applications, enabling dashboards, alarms, and automated responses. In cybersecurity, it serves as a critical data source for detecting anomalous activity and investigating incidents within AWS environments, since many security-relevant signals are exposed as CloudWatch metrics and logs. The recent cryptomining campaign targeting EC2 and ECS underscores the platform’s importance for visibility into cloud workloads and rapid detection of misuse.
Related Threat Clusters
-
Incident Response Playbook for Satellite Operations on AWS
The articles detail a two-part incident response playbook tailored for satellite operations using AWS. Part one focuses on detection and forensic readiness, emphasizing the unique challenges of satellite IR, such as…
2 articles · Updated June 19, 2026 -
Launch of AWS European Sovereign Cloud Enhances Data Sovereignty in Europe
On July 1, 2026, AWS launched the European Sovereign Cloud, a cloud service entirely located within the EU, designed to meet strict data residency and compliance requirements. This initiative aims to address regulatory…
2 articles · Updated July 1, 2026 -
Trend Vision One Integrates with AWS Security Hub for Enhanced Cloud Security
Trend Vision One has integrated with AWS Security Hub CSPM to improve AWS infrastructure security management. This integration allows organizations to streamline multiple security dashboards and tools, bringing critical…
2 articles · Updated December 10, 2025 -
AWS Launches AI Security Framework to Enhance Security for AI Workloads
On May 15, 2026, AWS introduced the AI Security Framework aimed at helping organizations secure AI workloads. The framework provides a structured model that aligns security controls with specific AI use cases, layers,…
2 articles · Updated May 15, 2026 -
AWS Shield Advanced Enhances DDoS Protection with New Rule Group
AWS Shield Advanced is integrating the AWS WAF Anti-DDoS managed rule group for application-layer DDoS protection. This change, effective July 27, 2026, will enhance the detection and mitigation of HTTP request floods,…
2 articles · Updated July 28, 2026 -
AWS IAM Credential Theft Fuels Ongoing Crypto Mining Campaign
A sophisticated cryptocurrency mining campaign targeting AWS customers began on November 2, 2025, using compromised AWS Identity and Access Management (IAM) credentials. The attackers exploited Amazon Elastic Container…
5 articles · Updated December 17, 2025
Recent Intelligence Reports
- AWS Shield Advanced is embracing the AWS WAF Anti-DDoS managed rule group: What changes and how to prepare — Aws.Amazon · July 27, 2026
- AWS Gateway Load Balancer — aws.amazon.com · July 2, 2026
- An incident response playbook for satellite operations on AWS (Part-2): Automated response ... — Aws.Amazon · June 19, 2026
- The AWS AI Security Framework: Securing AI with the right controls, at the right layers, at the right phases — Aws.Amazon · May 15, 2026
- Cryptomining campaign targeting Amazon EC2 and Amazon ECS — Aws.Amazon · December 16, 2025
- Trend Vision One™ Integration with AWS Security Hub CSPM: Unifying Cloud Security — Feeds.Trendmicro · December 10, 2025