PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 10 / c10.4
Efficient Threat DetectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c10.4 Automated log review and anomaly detection

Review audit logs in an automated way to identify anomalous or suspicious activity, going beyond daily manual review through automatic mechanisms.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: Medium Applies to CDE: Yes

Requirement 10

Log and Monitor All Access to System Components and Cardholder Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

10.4 Audit logs are reviewed to identify anomalies or suspicious activity
  • 10.4.1 Daily review of security events and critical component logs Covered
  • 10.4.1.1 Automated mechanisms used to perform log reviews Covered
  • 10.4.2 Logs of other system components reviewed periodically Your responsibility
  • 10.4.2.1 Frequency of periodic reviews defined by targeted risk analysis Your responsibility
  • 10.4.3 Exceptions and anomalies identified during review are addressed Your responsibility

How to implement on AWS

Analyze logs with CloudWatch Logs Insights and anomaly detection. Correlate signals with GuardDuty and consolidate in Security Hub. Define alarms and metrics for critical security events. Document the daily review of high-risk events through automated mechanisms.

Practical implementation

How this control is implemented in each reference architecture:

Review logs with automated mechanisms (not just eyeballs) to surface anomalous or suspicious activity daily.

  1. Analyze logs with CloudWatch Logs Insights queries and metric filters for high-risk events (root use, policy changes, failed auth).
    Account-wide detection CloudWatch
  2. Correlate signals with GuardDuty and consolidate in Security Hub as the automated daily review.
    Account-wide detection GuardDuty Security Hub
  3. Define alarms for critical security events and document that the daily review is automated (10.4.1.1).
    Account automation CloudWatch

How to validate: Logs Insights/metric filters and GuardDuty feed Security Hub, alarms fire on high-risk events, and the automated-review process is documented.

Avoid: Manual daily log scrolling. It does not scale and misses events; use automated mechanisms as 10.4.1.1 expects.

Single-account, 3-tier →

Aggregate logs and detections centrally so anomaly review spans every CDE account from a single pane.

  1. Aggregate GuardDuty and Config/Security Hub findings into the delegated-admin security tooling account.
    Security tooling account Security Hub GuardDuty
  2. Optionally run OpenSearch and/or Amazon Detective over the centralized logs for deeper anomaly analysis.
    Security tooling account OpenSearch Service Amazon Detective
  3. Alert and track exceptions centrally so anomalies in any account are reviewed and addressed.
    Security tooling account EventBridge

How to validate: The security tooling account shows correlated findings across all accounts, and anomaly exceptions are tracked to resolution centrally.

Avoid: Reviewing each account's logs separately. Aggregate detections centrally so review is complete and consistent.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine policies and observe processes to verify the required logs are reviewed at least once daily (10.4.1.a, 10.4.1.b).
  • Examine log-review mechanisms and interview personnel to verify automated mechanisms are used to perform the reviews (10.4.1.1).
  • Observe processes and interview personnel to verify exceptions and anomalies identified during review are addressed (10.4.3.b).

Evidence in AWS

  • CloudWatch Logs Insights queries/alarms on security events.
  • GuardDuty findings consolidated in Security Hub.
  • Evidence of automated review of high-risk logs.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 10.4 — Potentially suspicious or anomalous activities are quickly identified to minimize impact.

AWS services

Amazon CloudWatch Amazon GuardDuty AWS Security Hub Amazon OpenSearch Service

Learning resources

References

  • AWS Security Maturity Model: Alarms and analysis
  • PCI DSS v4.0.1 Requirement 10.4