Detection

See everything: GuardDuty, Security Hub, CloudTrail, logging architecture — 16%

• Monitoring and Alerting — Turning a workload into monitoring requirements: the four shapes a security signal takes, EventBridge as the spine, GuardDuty end to end, Security Hub as the aggregator, and Macie, Config and State Manager running continuous assessment. (4 lessons, 60 min)
• The Logging Architecture — The evidence layer: CloudTrail management, data and Insights events with organization trails and CloudTrail Lake, CloudWatch Logs from agent to subscription filter, choosing network and service logs by threat, and making the record tamper-resistant. (4 lessons, 65 min)
• Log Analysis at Scale — Reading terabytes without drowning: Security Lake and the OCSF normalization that makes a common query possible, picking between Logs Insights, Athena, OpenSearch and Managed Grafana on cost and latency, and correlating sources into one incident timeline. (3 lessons, 55 min)
• Troubleshooting Detection — The lesson every exam asks and no course teaches: an ordered checklist for missing logs, the per-service logging gaps in Lambda, API Gateway, CloudFront and Route 53, and the remediation patterns that keep a fix from drifting back. (3 lessons, 45 min)