# The camera: CloudTrail records, GuardDuty judges, Hub collects Source: https://ai.techclick.in/blog_aws_cloudtrail_guardduty_hub Markdown: https://ai.techclick.in/blog_aws_cloudtrail_guardduty_hub.md Publisher: Techclick Infosec Pvt Ltd CloudTrail is the camera. GuardDuty is findings. Security Hub aggregates. No org trail means no forensics. ## The ticket CISO: “Who deleted tc-lab-app-logs objects last month?” There is no trail. Event history never records S3 data events, and it is not an archive. GuardDuty is off. Security Hub is an empty subscription someone clicked once. Quick interview answer CloudTrail records AWS API activity. Create a trail (multi-region, org trail from the management or delegated admin account) that delivers to S3 — this lab would land in the Security OU, not in the app account. Console Event history is only recent management events; it is not your archive and it is not data events. GuardDuty analyzes CloudTrail, VPC Flow Logs, DNS, and other signals and emits findings — it is not a camera of every call. Security Hub aggregates findings (GuardDuty, Access Analyzer, Inspector, partners) and runs security standards. Disable the trail and you are blind on purpose. Hero · camera, not a siren GuardDuty without a trail still needs telemetry. A trail without anyone reading it is how last month disappears. Lab data · dummy only Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10 . Dummy account ID. Not yours. ## Mental model Service Job Not its job CloudTrail Record the API (camera) Tell you it was malicious GuardDuty Findings from telemetry Replace the trail archive Security Hub Aggregate + standards Be the only log store One way evidence flows Org trail every account - S3 log archive Security OU GuardDuty Security Hub Camera first. Findings second. Rollup third. Do not reverse that in an incident. https://111122223333.signin.aws.amazon.com/console Training mock · not live AWS console VPC IAM S3 CloudTrail CloudTrail → Trails ### org-trail-lab Trail type Organization trail · all member accounts · multi-region Storage Log-archive bucket in Security OU · SSE-KMS · integrity validation Management events All · read + write Data events Add S3 data events for tc-lab-app-logs when you need object-level forensics GuardDuty / Hub Detector on · Security Hub standards + finding ingest Cancel Save No trail = no forensics. Training mock. ## How to choose Question Where What API ran, as whom, from where, when? CloudTrail (trail in S3 / Lake), not a GuardDuty title Does this look like stolen creds / crypto / recon? GuardDuty finding Are we failing FSBP / CIS controls across accounts? Security Hub standards Object-level GetObject last month? Only if you enabled S3 data events on a trail ## Runbook #### Side A — camera Org trail, multi-region, log file validation, to a Security OU bucket that apps cannot delete. SCP (lesson 2) denies cloudtrail:StopLogging / delete-trail in Workloads. - #### Side B — findings Enable GuardDuty in the accounts (or delegated admin). Enable Security Hub and the standards you actually review. - #### Side C — prove Make a harmless API call. See it in the trail file / Lake. Confirm a detector id exists. Do not declare “logging is on” from Event history alone. aws cli · camera proof aws cloudtrail describe-trails # Name: org-trail-lab IsOrganizationTrail: true IsMultiRegionTrail: true # S3BucketName: tc-lab-org-trail LogFileValidationEnabled: true aws cloudtrail get-trail-status --name org-trail-lab # IsLogging: true aws guardduty list-detectors # detector-lab01 aws securityhub describe-hub # HubArn: arn:aws:securityhub:...:111122223333:hub/default ## Four failures ### 1 · No trail, only Event history Short window, management events, not an archive. You will lose last month. ### 2 · Trail in the app account, app role can s3:DeleteObject on the log bucket The suspect deletes the camera. Put logs in the Security OU with a restrictive bucket policy. ### 3 · GuardDuty on, trail off, “we have monitoring” Findings without durable API history. You cannot reconstruct. ### 4 · Security Hub enabled, nobody owns failed controls A dashboard is not a control. Assign the standard; do not screenshot it once a year. ## How to prove it Close only when 1) describe-trails shows an org, multi-region, logging trail. 2) The log bucket is not writable by AppEC2Role. 3) GuardDuty has a detector. 4) You can find your own test API in the trail. ## Traps Said in interview Correction GuardDuty is our CloudTrail Different products — camera vs findings Event history is the trail It is not durable org-wide evidence Hub stores every API call Hub stores findings and control results ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 CloudTrail’s job is… To emit malware signatures only To record API activity — the camera To replace SGs To terminate VPN tunnels Correct: b . Camera. Q2 No trail means… Event history is a full forensic archive No durable forensics — Event history is not the archive and has no data events GuardDuty stores every API S3 is public Correct: b . No trail = no forensics. Q3 GuardDuty produces… A complete API camera roll Findings from telemetry SCPs NACL numbers Correct: b . Findings. Q4 Security Hub is… The aggregator of findings + standards A replacement for KMS A TGW attachment An instance profile Correct: a . Aggregator. Q5 Where should the org trail bucket live? Writable by AppEC2Role in Workloads Security OU log-archive, locked down A public website bucket On the FortiGate flash Correct: b . Camera away from the suspect. Q6 Object-level GetObject last month requires… S3 data events on a trail that existed then SG flow only Root MFA A custom NACL Correct: a . Data events. Check answers Reset AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview ## Sources - AWS CloudTrail User Guide . - Amazon GuardDuty — What is GuardDuty . - AWS Security Hub — What is Security Hub . Related: AWS session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt