c11.3 Network intrusion detection
Use intrusion detection techniques to detect and alert on intrusions at the perimeter and at critical points of the CDE, keeping the mechanisms up to date.
Requirement 11
Test Security of Systems and Networks Regularly
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
11.5 Network intrusions and unexpected file changes are detected and responded to
- 11.5.1 Intrusion-detection/prevention techniques detect/alert/prevent Covered
- 11.5.1.1 IDS/IPS detects, alerts, and addresses covert malware (SP only) Covered
- 11.5.2 Change-detection mechanism (FIM) alerts on unauthorized changes Covered
How to implement on AWS
Enable GuardDuty (including VPC Flow Logs and DNS analysis) for agentless intrusion detection. Complement with AWS Network Firewall IPS rules (Suricata) at the CDE perimeter. Alert on and respond to findings through Security Hub/EventBridge.
Practical implementation
How this control is implemented in each reference architecture:
Detect intrusions at the perimeter and critical CDE points with agentless detection plus IPS, and keep the mechanisms current.
- Enable GuardDuty with VPC Flow Logs and DNS analysis for agentless intrusion detection.Account-wide detection
GuardDuty 
Amazon VPC - Add AWS Network Firewall IPS rules (Suricata signatures) at the CDE perimeter, keeping the rule set updated.Inspection subnets (in VPC)
Network Firewall - Alert on and respond to findings via Security Hub and EventBridge.Account automation
Security Hub 
EventBridge
How to validate: GuardDuty covers flow/DNS, Network Firewall IPS is active at the perimeter with current signatures, and findings raise alerts.
Avoid: Relying on security groups alone for intrusion detection. They filter but do not detect/alert; add GuardDuty and IPS.
Detect intrusions across every CDE account with org-wide GuardDuty and centrally managed IPS in the inspection VPC.
- Run GuardDuty org-wide (delegated admin) so flow/DNS-based detection covers every CDE account.Security tooling account → PCI OU GuardDuty
AWS Organizations - Apply IPS centrally in the inspection VPC (network account) with one consistently managed Network Firewall rule set.Network/inspection account Network Firewall
Transit Gateway - Alert centrally from the security tooling account so responses are consistent.Security tooling account Security Hub EventBridge
How to validate: GuardDuty is enabled org-wide, all CDE traffic transits the central IPS, and intrusion alerts surface centrally.
Avoid: A separate IPS per account. Policy drifts; centralize inspection in the network account.
PCI validation
Testing procedures
- Examine system configurations and network diagrams to verify intrusion-detection/prevention techniques monitor traffic at the perimeter and at critical points of the CDE (11.5.1.a).
- Examine configurations and interview personnel to verify the techniques alert personnel of suspected compromises and are kept up to date (engines, baselines, signatures) (11.5.1.b, 11.5.1.c).
Evidence in AWS
- GuardDuty enabled with VPC Flow Logs and DNS analysis.
- AWS Network Firewall IPS rules active at the CDE perimeter.
- Alerting and handling of findings in Security Hub.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 11.5 — Mechanisms to detect real-time suspicious or anomalous network traffic that may indicate threat actor activity are implemented, and alerts are responded to.
AWS services
Amazon GuardDuty AWS Network Firewall AWS Security Hub Learning resources
References
- PCI DSS v4.0.1 Requirement 11.5