Detection

An alert is the main component of the detection phase. It generates a notification to initiate the incident response process based on AWS account activity of interest.

Alerting accuracy is challenging; it’s not always possible to determine with complete certainty if an incident has occurred, is in progress, or if it will happen in the future. Here are a few reasons:

• Detection mechanisms are based on baseline deviation, known patterns, and notification from internal or external entities.

• Because of the unpredictable nature of technology and people, respectively the means and the actors of security incidents, baselines change over time. Rogue patterns emerge through novel or modified threat actor tactics, techniques, and procedures (TTPs).

• Changes to people, technology, and processes are not immediately incorporated into the incident response process. Some are discovered during the progress of an investigation.