WAF-SEC-080 – Security Monitoring & Threat Detection

Pillar: Security | Severity: High | Category: Identity Access | Automatable: High

Description

AWS CloudTrail MUST be enabled as a multi-region trail with log file validation and global service event inclusion. GuardDuty MUST be enabled in all active AWS regions. AWS Security Hub or an equivalent SIEM MUST be enabled to aggregate and correlate security findings centrally. CloudTrail logs MUST be stored in a dedicated S3 bucket with server-side encryption and MFA delete enabled. Alerts MUST be configured for critical Security Hub findings and GuardDuty HIGH/CRITICAL severity findings. All security alerts MUST route to an on-call escalation channel with a defined response SLA.

Rationale

Risk	Description
Risk	Security incidents go undetected without centralised, tamper-proof audit logs.
Risk	Forensic investigations are delayed or inconclusive when logs are missing.

Risk

Description

Risk

Security incidents go undetected without centralised, tamper-proof audit logs.

Risk

Forensic investigations are delayed or inconclusive when logs are missing.

Requirements

AWS CloudTrail MUST be enabled as a multi-region trail with log file validation and global service event inclusion.
GuardDuty MUST be enabled in all active AWS regions.
AWS Security Hub or an equivalent SIEM MUST be enabled to aggregate and correlate security findings centrally.
CloudTrail logs MUST be stored in a dedicated S3 bucket with server-side encryption and MFA delete enabled.
Alerts MUST be configured for critical Security Hub findings and GuardDuty HIGH/CRITICAL severity findings.
All security alerts MUST route to an on-call escalation channel with a defined response SLA.

Implementation Guidance

Implement the required configuration as code in Terraform or equivalent IaC.
Add an automated check to CI/CD so deviations are caught before deployment.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sec-080.tf.aws.cloudtrail-multi-region

Engine: terraform | Provider: aws | Automated: Yes

CloudTrail must be enabled as a multi-region trail with log file validation

An aws_cloudtrail resource must exist with is_multi_region_trail = true, enable_log_file_validation = true, and include_global_service_events = true to ensure complete API activity coverage across all regions and global services.

Scope: resource — aws_cloudtrail

Assertions: * is_multi_region_trail is true — CloudTrail must be a multi-region trail to capture API activity in all regions. * enable_log_file_validation is true — CloudTrail log file validation must be enabled to detect log tampering. * include_global_service_events is true — CloudTrail must include global service events (e.g., IAM API calls).

Remediation: Set is_multi_region_trail = true, enable_log_file_validation = true, and include_global_service_events = true on the aws_cloudtrail resource. Ensure the trail S3 bucket has SSE-KMS encryption and is not publicly accessible.

Compliant

resource "aws_cloudtrail" "main" {
  name                          = "org-cloudtrail"
  s3_bucket_name                = aws_s3_bucket.cloudtrail_logs.id
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  include_global_service_events = true
  kms_key_id                    = aws_kms_key.cloudtrail.arn
  tags = {
    owner       = "security-team"
    environment = "all"
  }
}

Non-Compliant

resource "aws_cloudtrail" "main" {
  name                          = "org-cloudtrail"
  s3_bucket_name                = aws_s3_bucket.cloudtrail_logs.id
  is_multi_region_trail         = false  # WAF-SEC-080 violation
  enable_log_file_validation    = false  # WAF-SEC-080 violation
  include_global_service_events = false  # WAF-SEC-080 violation
}

waf-sec-080.tf.aws.guardduty-enabled

Engine: terraform | Provider: aws | Automated: Yes

GuardDuty must be enabled in all active regions

An aws_guardduty_detector resource must exist with enable = true in each active AWS region. GuardDuty provides continuous threat detection and is a foundational security detective control.

Scope: resource — aws_guardduty_detector

Assertions: * enable is true — GuardDuty detector must be enabled (enable = true).

Remediation: Create an aws_guardduty_detector resource with enable = true in each active AWS region. For multi-account environments, configure GuardDuty at the organization level using aws_guardduty_organization_configuration to automatically enable GuardDuty in all existing and future member accounts.

Compliant

resource "aws_guardduty_detector" "main" {
  enable = true
  datasources {
    s3_logs { enable = true }
    kubernetes { audit_logs { enable = true } }
    malware_protection { scan_ec2_instance_with_findings { ebs_volumes { enable = true } } }
  }
}

Non-Compliant

resource "aws_guardduty_detector" "main" {
  enable = false  # WAF-SEC-080 violation: GuardDuty must be enabled
}

waf-sec-080.tf.aws.securityhub-enabled

Engine: terraform | Provider: aws | Automated: Yes

AWS Security Hub must be enabled

An aws_securityhub_account resource must exist to enable Security Hub in the account, providing centralized aggregation of security findings from GuardDuty, Amazon Inspector, AWS Config, Macie, and other integrated services.

Scope: resource — aws_securityhub_account

Assertions: * `` block exists — AWS Security Hub must be enabled (aws_securityhub_account resource must exist).

Remediation: Add an aws_securityhub_account resource to the Terraform configuration. After enabling Security Hub, activate standards using aws_securityhub_standards_subscription: - arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0 - arn:aws:securityhub:REGION::standards/aws-foundational-security-best-practices/v/1.0.0

Compliant

resource "aws_securityhub_account" "main" {}
resource "aws_securityhub_standards_subscription" "cis" {
  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0"
  depends_on    = [aws_securityhub_account.main]
}
resource "aws_securityhub_standards_subscription" "fsbp" {
  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/aws-foundational-security-best-practices/v/1.0.0"
  depends_on    = [aws_securityhub_account.main]
}

Non-Compliant

# aws_securityhub_account resource absent – WAF-SEC-080 violation
# Security Hub is not enabled in this account

waf-sec-080.tf.azurerm.sentinel-enabled

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Sentinel must be onboarded to a Log Analytics workspace

An azurerm_sentinel_log_analytics_workspace_onboarding resource must exist so that Azure Sentinel can centrally collect, detect, and investigate security events across the subscription.

Scope: resource — azurerm_sentinel_log_analytics_workspace_onboarding

Assertions: * workspace_id attribute exists — Azure Sentinel onboarding must reference a Log Analytics workspace ID.

Remediation: Create a Log Analytics workspace and onboard it to Sentinel using azurerm_sentinel_log_analytics_workspace_onboarding. Configure data connectors for Azure Activity, Microsoft Entra ID, and any workload-specific sources.

Compliant

resource "azurerm_log_analytics_workspace" "sec" {
  name                = "sec-workspace"
  location            = azurerm_resource_group.sec.location
  resource_group_name = azurerm_resource_group.sec.name
  sku                 = "PerGB2018"
}

resource "azurerm_sentinel_log_analytics_workspace_onboarding" "sec" {
  workspace_id = azurerm_log_analytics_workspace.sec.id
}

Non-Compliant

# No azurerm_sentinel_log_analytics_workspace_onboarding resource exists.
# WAF-SEC-080 violation: Azure Sentinel is not enabled for threat detection

waf-sec-080.tf.azurerm.security-center-standard

Engine: terraform | Provider: azurerm | Automated: Yes

Microsoft Defender for Cloud must be enabled at standard tier

An azurerm_security_center_subscription_pricing resource must exist with tier set to "Standard" to enable Microsoft Defender for Cloud threat detection and secure score recommendations.

Scope: resource — azurerm_security_center_subscription_pricing

Assertions: * tier equals Standard — Microsoft Defender for Cloud must be enabled at Standard tier.

Remediation: Create azurerm_security_center_subscription_pricing with tier = "Standard" for the relevant resource types (e.g., VirtualMachines, SqlServers, ContainerRegistries). Ensure all active resource types are covered.

Compliant

resource "azurerm_security_center_subscription_pricing" "main" {
  tier = "Standard"
}

Non-Compliant

resource "azurerm_security_center_subscription_pricing" "main" {
  tier = "Free"  # WAF-SEC-080 violation: Defender for Cloud standard tier required
}

waf-sec-080.tf.google.logging-project-sink

Engine: terraform | Provider: google | Automated: Yes

GCP audit logs must be exported to a persistent destination

A google_logging_project_sink resource must exist to route GCP audit logs to Cloud Logging, BigQuery, Cloud Storage, or Pub/Sub for long-term retention and analysis.

Scope: resource — google_logging_project_sink

Assertions: * destination attribute exists — GCP logging sink must define a persistent destination for audit logs.

Remediation: Create a google_logging_project_sink with filter including audit log events and destination pointing to a secure BigQuery dataset or Cloud Storage bucket. Ensure the sink service account has appropriate permissions.

Compliant

resource "google_logging_project_sink" "audit" {
  name        = "audit-logs-to-bigquery"
  destination = "bigquery.googleapis.com/projects/${var.project_id}/datasets/audit_logs"
  filter      = "protoPayload.@type=\"type.googleapis.com/google.cloud.audit.AuditLog\""

  unique_writer_identity = true
}

Non-Compliant

# No google_logging_project_sink routes audit logs to a persistent store.
# WAF-SEC-080 violation: GCP audit logs lack central export

waf-sec-080.tf.google.security-command-center

Engine: terraform | Provider: google | Automated: Yes

Google Security Command Center must be enabled

A google_security_center_notification_config or google_scc_notification_config resource must exist to enable Security Command Center findings and centralize threat detection across the GCP organization.

Scope: resource — google_security_center_notification_config, google_scc_notification_config

Assertions: * pubsub_topic attribute exists — Security Command Center notification config must route findings to a Pub/Sub topic.

Remediation: Enable Security Command Center at the organization level and create a google_security_center_notification_config or google_scc_notification_config to route HIGH/CRITICAL findings to a Pub/Sub topic and on-call channel.

Compliant

resource "google_security_center_notification_config" "high_critical" {
  config_id    = "high-critical-findings"
  organization = var.org_id
  pubsub_topic = google_pubsub_topic.scc.id

  streaming_config {
    filter = "severity = \"HIGH\" OR severity = \"CRITICAL\""
  }
}

Non-Compliant

# No Security Command Center notification config exists.
# WAF-SEC-080 violation: GCP threat detection not centralized

waf-sec-080.tf.stackit.log-service-enabled

Engine: terraform | Provider: stackit | Automated: Yes

STACKIT Log Service must collect audit and security logs

A stackit_log_service resource must be configured to centralise audit and security logs from STACKIT workloads. Logs must be retained and protected from tampering.

Scope: resource — stackit_log_service

Assertions: * name attribute exists — STACKIT Log Service must be configured for security log collection.

Remediation: Create a stackit_log_service instance and configure workload integrations to forward security-relevant logs. Define retention and access controls.

Compliant

resource "stackit_log_service" "security" {
  project_id = var.stackit_project_id
  name       = "security-logs"
}

Non-Compliant

# No stackit_log_service centralises STACKIT security logs.
# WAF-SEC-080 violation: logging not centralised

waf-sec-080.config.ovh.ovh-identity-access

Engine: config | Provider: ovh | Automated: Yes

OVHcloud workloads must centralise audit and security logs

A version-controlled policy document must exist at docs/security/waf-sec-080-ovh-identity-access.md and document the OVHcloud implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-080-ovh-identity-access.md

Remediation: Create or update docs/security/waf-sec-080-ovh-identity-access.md. State the requirement, how it is implemented for OVHcloud, the review cadence, and the owner.

Compliant

docs/security/waf-sec-080-ovh-identity-access.md:
- The OVHcloud implementation of WAF-SEC-080 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-080-ovh-identity-access.md` is missing or does not contain a normative requirement.
# WAF-SEC-080 violation: OVHcloud control is not documented

waf-sec-080.tf.hcloud.server-backups-and-logs

Engine: terraform | Provider: hcloud | Automated: Yes

Hetzner Cloud servers must have backup and log forwarding enabled

Hetzner Cloud production servers must have backups enabled and forward security logs to a centralised store. Backup and log retention must be defined.

Scope: resource — hcloud_server

Assertions: * backups is true — Hetzner Cloud production server must have backups enabled for log and state retention.

Remediation: Enable backups on hcloud_server resources and configure log forwarding via cloud-init or configuration management. Document retention and alerting.

Compliant

resource "hcloud_server" "app" {
  name        = "app-server"
  server_type = "cx22"
  image       = "ubuntu-22.04"
  backups     = true
  # Log forwarding configured via cloud-init
}

Non-Compliant

resource "hcloud_server" "app" {
  name        = "app-server"
  server_type = "cx22"
  image       = "ubuntu-22.04"
  backups     = false  # WAF-SEC-080 violation: backups disabled
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO 27001:2022	* A.8.15 – Logging * A.8.16 – Monitoring activities * A.5.26 – Response to information security incidents
ISO 27017	* CLD.12.4 – Logging and monitoring of cloud services
CIS Controls v8	* CIS 8 – Audit Log Management * CIS 13 – Network Monitoring and Defense
CSA STAR	* CCM LOG-01 – Logging and Monitoring Policy * CCM SEF-01 – Security Incident Management Policy
PCI DSS v4.0	* Req 10 – Log and monitor all access * Req 11.5 – Detect intrusions and unexpected file changes
SOC 2 Type II	* CC7.2 – System anomaly detection * CC7.4 – Detection and monitoring of security events
GDPR	* Art. 32 – Security of processing * Art. 33 – Breach notification to supervisory authority
NIS2	* Art. 21(2)(b) – Incident handling * Art. 23 – Reporting obligations
DORA	* Art. 10 – Detection of ICT-related incidents * Art. 13 – ICT incident reporting
EUCS (ENISA)	* LOG-01 – Audit logging * OPS-06 – Security monitoring
BSI C5:2020	* RB-10 – Logging and monitoring * RB-11 – Log integrity and retention * SIM-01 – Security incident management
IT-Grundschutz	* DER.1 – Detektion sicherheitsrelevanter Ereignisse * OPS.1.1.5 – Protokollierung
TISAX	* Information security – Security event logging and monitoring
ANSSI SecNumCloud	* Domain – Log management and security monitoring
BIO	* BIO – Logging en monitoring
ENS High	* op.exp.8 – Registro de actividad * op.exp.9 – Registro de la gestión de incidentes
UK NCSC CAF	* C1 – Security monitoring * C2 – Proactive security event discovery
UK GDPR	* Art. 32 – Security of processing * Art. 33 – Breach notification
NIST SP 800-53	* AU-2 – Event Logging * AU-6 – Audit Record Review * SI-4 – System Monitoring * IR-4 – Incident Handling
NIST CSF 2.0	* DE.CM-01 – Networks are monitored to detect events * DE.AE-02 – Detected events are analyzed
FedRAMP	* AU-2, AU-6, SI-4, IR-4 (Moderate/High baseline)
HIPAA	* § 164.308(a)(1)(ii)(D) – Information system activity review * § 164.312(b) – Audit controls
CMMC 2.0	* AU.L2-3.3.1 – System auditing * SI.L2-3.14.6 – Monitor system for attacks
ASD Essential 8	* ISM – Event logging and auditing
IRAP	* ISM – Event logging and security monitoring
CCCS PBMM	* AU-2, SI-4 – Audit and system monitoring
MAS TRM	* Ch.10 – Security incident management
ISMAP	* Logging, monitoring and security incident detection
FISC	* Operational measures – Security event monitoring

Framework

Controls

ISO 27001:2022

* A.8.15 – Logging * A.8.16 – Monitoring activities * A.5.26 – Response to information security incidents

ISO 27017

* CLD.12.4 – Logging and monitoring of cloud services

CIS Controls v8

* CIS 8 – Audit Log Management * CIS 13 – Network Monitoring and Defense

CSA STAR

* CCM LOG-01 – Logging and Monitoring Policy * CCM SEF-01 – Security Incident Management Policy

PCI DSS v4.0

* Req 10 – Log and monitor all access * Req 11.5 – Detect intrusions and unexpected file changes

SOC 2 Type II

* CC7.2 – System anomaly detection * CC7.4 – Detection and monitoring of security events

GDPR

* Art. 32 – Security of processing * Art. 33 – Breach notification to supervisory authority

NIS2

* Art. 21(2)(b) – Incident handling * Art. 23 – Reporting obligations

DORA

* Art. 10 – Detection of ICT-related incidents * Art. 13 – ICT incident reporting

EUCS (ENISA)

* LOG-01 – Audit logging * OPS-06 – Security monitoring

BSI C5:2020

* RB-10 – Logging and monitoring * RB-11 – Log integrity and retention * SIM-01 – Security incident management

IT-Grundschutz

* DER.1 – Detektion sicherheitsrelevanter Ereignisse * OPS.1.1.5 – Protokollierung

TISAX

* Information security – Security event logging and monitoring

ANSSI SecNumCloud

* Domain – Log management and security monitoring

BIO

* BIO – Logging en monitoring

ENS High

* op.exp.8 – Registro de actividad * op.exp.9 – Registro de la gestión de incidentes

UK NCSC CAF

* C1 – Security monitoring * C2 – Proactive security event discovery

UK GDPR

* Art. 32 – Security of processing * Art. 33 – Breach notification

NIST SP 800-53

* AU-2 – Event Logging * AU-6 – Audit Record Review * SI-4 – System Monitoring * IR-4 – Incident Handling

NIST CSF 2.0

* DE.CM-01 – Networks are monitored to detect events * DE.AE-02 – Detected events are analyzed

FedRAMP

* AU-2, AU-6, SI-4, IR-4 (Moderate/High baseline)

HIPAA

* § 164.308(a)(1)(ii)(D) – Information system activity review * § 164.312(b) – Audit controls

CMMC 2.0

* AU.L2-3.3.1 – System auditing * SI.L2-3.14.6 – Monitor system for attacks

ASD Essential 8

* ISM – Event logging and auditing

IRAP

* ISM – Event logging and security monitoring

CCCS PBMM

* AU-2, SI-4 – Audit and system monitoring

MAS TRM

* Ch.10 – Security incident management

ISMAP

* Logging, monitoring and security incident detection

FISC

* Operational measures – Security event monitoring