Collect and protect AWS logs
Send host data to CloudWatch, protect sensitive log fields, and retrieve records from the command line.
Practice cloud defense on AWS
AWS Monitoring and Detection Hands-On Labs
Learn to collect AWS security data, detect suspicious activity, investigate findings, and automate response in real cloud environments.
Premium membership required
70,000+ people learn with Cybr
- Real AWS telemetry
- Detection and response labs
- No cloud bill
Choose a featured defense lab
Turn AWS activity into useful security signals
Build a CloudWatch security dashboard, inspect network traffic, explore managed threat findings, and automate containment.
PremiumCloudWatch dashboardsSecurity Observability with CloudWatch Dashboards
Build a CloudWatch dashboard that surfaces important security activity.
Open lab
PremiumNetwork detectionDetect Suspicious Network Traffic with VPC Flow Logs
Collect VPC Flow Logs and investigate suspicious network traffic.
Open lab
PremiumManaged threat detectionAmazon GuardDuty Sandbox
Explore Amazon GuardDuty findings in a safe AWS sandbox.
Open lab
PremiumAutomated responseAutomated Security Response with EventBridge and Lambda
Connect a security event to automatic containment with EventBridge and Lambda.
Open lab
PremiumVulnerability detectionFind vulnerable Lambda Functions with Amazon Inspector
Use Amazon Inspector to find vulnerable Lambda functions and review the findings.
Open lab
AWS defense topics
Build practical monitoring and detection skills
The collection covers telemetry, log protection, security dashboards, managed findings, identity evidence, threat hunting, and automated response.
Detect threats and investigate activity
Use AWS telemetry and managed security services to find suspicious behavior, vulnerable workloads, and network activity.
Review identity evidence
Generate IAM account evidence and query it for inactive, exposed, or risky credentials.
Automate containment and recovery
Turn security events and unsafe settings into automatic containment, repair, and access-control actions.
Hunt for risk across AWS resources
Find abandoned resources, exposed services, unsafe data settings, and broad encryption-key access across AWS accounts.
- Hunting for Ghost Databases in the Cloud
- Remediating Ghost Databases in the Cloud
- Find S3 Security Misconfigurations with Prowler
- Query AWS Accounts for S3 Security Issues Using Steampipe
- Reduce Your AWS Attack Surface with Port Scanning
- Securing S3 Against Ransomware with YES3
- Audit the Blast Radius of KMS Keys with Finders Keypers
Free cheat sheets
AWS logging, detection, and response cheat sheets
References for CloudTrail event coverage, log investigation, continuous security assessments, and incident response.
- CloudTrail events and data recording cheat sheet
Compare management, data, and Insights events, plus event history and trails, to understand which activity gets recorded.
- AWS CloudTrail CLI cheat sheet
Look up commands for trails, event history, and local log searches when investigating AWS API activity.
- AWS CloudTrail security controls checklist
Review logging coverage, log file validation, encryption, and monitoring controls to protect investigation evidence.
- Prowler and Security Hub continuous assessments cheat sheet
A reference architecture for scheduled Prowler scans, S3 reports, and centralized Security Hub findings.
- IAM credential exposure incident response playbook
Connect identity evidence and suspicious activity to containment, eradication, recovery, and post-incident review.
- Cloud attack simulations cheat sheet
Explore adversary-emulation workflows for testing whether monitoring and response controls detect the expected behavior.
How the labs work
Practice AWS defense without using your cloud account
Cybr prepares the AWS environment for each lab. You can focus on evidence, detections, and response instead of setup, billing, and cleanup.
- Step 01
Choose a defense lab
Choose a monitoring, detection, hunting, or response scenario that matches your goals.
- Step 02
Launch the environment
Get the AWS resources, telemetry, access, and instructions that the lab requires.
- Step 03
Complete the investigation
Collect evidence, find suspicious activity, and apply the required response.
Isolated AWS training environments
Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs.
Continue with a structured path
Build complete AWS detection and response skills
Use the Blue Team path for practical cloud defense. Use the Security Specialty path for broader AWS security coverage and exam preparation.
- AWS Blue Team
Build defensive skills in monitoring, threat detection, investigation, response, governance, and security automation.
- AWS Certified Security Specialty
Study threat detection, incident response, security logging, monitoring, infrastructure defense, and data protection.
Before you start
AWS monitoring and detection lab FAQ
Do I need a Premium membership?
Yes. The featured monitoring and detection labs require Premium membership. The IAM credentials report lab in the skills list is free.
Do I need my own AWS account?
No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate.
How much AWS experience do I need?
Beginners can start with account evidence and guided log tasks. Later labs cover threat hunting, managed findings, containment, and automated response.
What monitoring and detection skills can I practice?
Labs cover CloudWatch, VPC Flow Logs, GuardDuty, Inspector, IAM reports, EventBridge, Lambda, AWS Config, Prowler, Steampipe, and incident response.
Can I safely investigate suspicious AWS activity?
Yes. Each scenario runs in an isolated training environment. You can inspect threats and apply response actions without risking production resources.
Will AWS charge me for the lab resources?
No. Cybr provides the AWS environment, covers its cloud costs, and removes the resources after your session.
Start an AWS monitoring and detection lab
Build a CloudWatch security dashboard in a guided AWS environment, then continue through detection, investigation, and response scenarios.
Premium membership required