---
title: "AWS Monitoring and Detection Hands-On Labs | Cybr"
description: "Practice AWS monitoring and threat detection with hands-on labs for CloudWatch, VPC Flow Logs, GuardDuty, Inspector, EventBridge, and incident response."
url: https://cybr.com/hands-on-labs/aws-monitoring-detection/
---

Practice cloud defense on AWS

# AWS Monitoring and Detection Hands-On Labs

Learn to collect AWS security data, detect suspicious activity, investigate findings, and automate response in real cloud environments.

[Start the CloudWatch lab →](https://cybr.com/hands-on-labs/lab/security-observability-with-cloudwatch-dashboards/)

Premium membership required

![AWS security observability with Amazon CloudWatch](https://media.cybr.com/2025/07/Security-Observability-with-CloudWatch-banner-624x624.jpg)

![Johnny Endrihs](https://media.cybr.com/2025/12/johnny-endrihs.jpg)![Christopher](https://media.cybr.com/2023/09/christopher-krisnd.jpeg)![Rafael Martinez](https://media.cybr.com/2024/02/rafael-martinez.jpeg)![Lixin Zhang](https://media.cybr.com/2023/07/lixin-zhang.jpeg)![Karan Thakkar](https://media.cybr.com/2025/11/karan-thakkar.png)

**80,000+** people learn with Cybr

- Real AWS telemetry
- Detection and response labs
- No cloud bill

![Cisco](https://cybr.comhttps//media.cybr.com/2026/08/cisco-light-360.png)![Verizon](https://cybr.comhttps//media.cybr.com/2026/08/verizon-light-360.png)![Toyota](https://cybr.comhttps//media.cybr.com/2026/08/toyota-light-360.png)![Check Point](https://cybr.comhttps//media.cybr.com/2026/08/checkpoint-light-360.png)![Moody’s](https://cybr.comhttps//media.cybr.com/2026/08/moodys-light-360.png)![AT&T](https://cybr.comhttps//media.cybr.com/2026/08/att-light-360.png)![Virginia Tech](https://cybr.comhttps//media.cybr.com/2026/08/virginiatech-light-360.png)

Choose a featured defense lab

## Turn AWS activity into useful security signals

Build a CloudWatch security dashboard, inspect network traffic, explore managed threat findings, and automate containment.

1.

   Premium

   CloudWatch dashboards

   ### Security Observability with CloudWatch Dashboards

   Build a CloudWatch dashboard that surfaces important security activity.

   Open lab

   [Security Observability with CloudWatch Dashboards](https://cybr.com/hands-on-labs/lab/security-observability-with-cloudwatch-dashboards/)

2.

   Premium

   Network detection

   ### Detect Suspicious Network Traffic with VPC Flow Logs

   Collect VPC Flow Logs and investigate suspicious network traffic.

   Open lab

   [Detect Suspicious Network Traffic with VPC Flow Logs](https://cybr.com/hands-on-labs/lab/detect-suspicious-network-traffic-with-vpc-flow-logs/)

3.

   Premium

   Managed threat detection

   ### Amazon GuardDuty Sandbox

   Explore Amazon GuardDuty findings in a safe AWS sandbox.

   Open lab

   [Amazon GuardDuty Sandbox](https://cybr.com/hands-on-labs/lab/amazon-guardduty-sandbox/)

4.

   Premium

   Automated response

   ### Automated Security Response with EventBridge and Lambda

   Connect a security event to automatic containment with EventBridge and Lambda.

   Open lab

   [Automated Security Response with EventBridge and Lambda](https://cybr.com/hands-on-labs/lab/automated-security-response-with-eventbridge-and-lambda/)

5.

   Premium

   Vulnerability detection

   ### Find vulnerable Lambda Functions with Amazon Inspector

   Use Amazon Inspector to find vulnerable Lambda functions and review the findings.

   Open lab

   [Find vulnerable Lambda Functions with Amazon Inspector](https://cybr.com/hands-on-labs/lab/amazon-inspector-sandbox/)

[Browse the complete lab catalog](https://cybr.com/hands-on-labs/)

AWS defense topics

## Build practical monitoring and detection skills

The collection covers telemetry, log protection, security dashboards, managed findings, identity evidence, threat hunting, and automated response.

### Collect and protect AWS logs

Send host data to CloudWatch, protect sensitive log fields, and retrieve records from the command line.

- [Install and Configure the Amazon CloudWatch Unified Agent on EC2](https://cybr.com/hands-on-labs/lab/install-and-configure-the-amazon-cloudwatch-unified-agent-on-ec2/)
- [Protect CloudWatch Logs Data with Masking Policies](https://cybr.com/hands-on-labs/lab/protect-cloudwatch-logs-data-with-masking-policies/)
- [Easily Retrieve CloudWatch Logs from the CLI with awslogs](https://cybr.com/hands-on-labs/lab/easily-retrieve-cloudwatch-logs-from-the-cli-with-awslogs/)

### Detect threats and investigate activity

Use AWS telemetry and managed security services to find suspicious behavior, vulnerable workloads, and network activity.

- [Security Observability with CloudWatch Dashboards](https://cybr.com/hands-on-labs/lab/security-observability-with-cloudwatch-dashboards/)
- [Detect Suspicious Network Traffic with VPC Flow Logs](https://cybr.com/hands-on-labs/lab/detect-suspicious-network-traffic-with-vpc-flow-logs/)
- [Amazon GuardDuty Sandbox](https://cybr.com/hands-on-labs/lab/amazon-guardduty-sandbox/)
- [Find Vulnerable Lambda Functions with Amazon Inspector](https://cybr.com/hands-on-labs/lab/amazon-inspector-sandbox/)

### Review identity evidence

Generate IAM account evidence and query it for inactive, exposed, or risky credentials.

- [Generate IAM Credentials Reports](https://cybr.com/hands-on-labs/lab/generate-iam-credentials-reports/)
- [Query IAM Credentials Reports with Steampipe](https://cybr.com/hands-on-labs/lab/query-iam-credentials-reports-with-steampipe/)

### Automate containment and recovery

Turn security events and unsafe settings into automatic containment, repair, and access-control actions.

- [Automated Security Response with EventBridge and Lambda](https://cybr.com/hands-on-labs/lab/automated-security-response-with-eventbridge-and-lambda/)
- [Remediate Open SSH Security Groups with AWS Config and SSM](https://cybr.com/hands-on-labs/lab/remediate-open-ssh-security-groups-with-aws-config-and-ssm/)
- [Automated S3 Remediation to Enforce Block Public Access](https://cybr.com/hands-on-labs/lab/automated-s3-remediation-to-enforce-block-public-access/)

### Hunt for risk across AWS resources

Find abandoned resources, exposed services, unsafe data settings, and broad encryption-key access across AWS accounts.

- [Hunting for Ghost Databases in the Cloud](https://cybr.com/hands-on-labs/lab/hunting-for-ghost-databases-in-the-cloud/)
- [Remediating Ghost Databases in the Cloud](https://cybr.com/hands-on-labs/lab/remediating-ghost-databases-in-the-cloud/)
- [Find S3 Security Misconfigurations with Prowler](https://cybr.com/hands-on-labs/lab/find-s3-security-misconfigurations-with-prowler/)
- [Query AWS Accounts for S3 Security Issues Using Steampipe](https://cybr.com/hands-on-labs/lab/query-aws-accounts-for-s3-security-issues-using-steampipe/)
- [Reduce Your AWS Attack Surface with Port Scanning](https://cybr.com/hands-on-labs/lab/reduce-aws-attack-surface-with-port-scanning/)
- [Securing S3 Against Ransomware with YES3](https://cybr.com/hands-on-labs/lab/securing-s3-against-ransomware-with-yes3/)
- [Audit the Blast Radius of KMS Keys with Finders Keypers](https://cybr.com/hands-on-labs/lab/audit-the-blast-radius-of-kms-keys-with-finders-keypers/)

Free cheat sheets

## AWS logging, detection, and response cheat sheets

References for CloudTrail event coverage, log investigation, continuous security assessments, and incident response.

- [CloudTrail events and data recording cheat sheet](https://cybr.com/cheat-sheets/cloudtrail-events-data-recording/)

  Compare management, data, and Insights events, plus event history and trails, to understand which activity gets recorded.

- [AWS CloudTrail CLI cheat sheet](https://cybr.com/cheat-sheets/cloudtrail-cli/)

  Look up commands for trails, event history, and local log searches when investigating AWS API activity.

- [AWS CloudTrail security controls checklist](https://cybr.com/cheat-sheets/cloudtrail-security-controls/)

  Review logging coverage, log file validation, encryption, and monitoring controls to protect investigation evidence.

- [Prowler and Security Hub continuous assessments cheat sheet](https://cybr.com/cheat-sheets/prowler-security-hub/)

  A reference architecture for scheduled Prowler scans, S3 reports, and centralized Security Hub findings.

- [IAM credential exposure incident response playbook](https://cybr.com/cheat-sheets/iam-credential-exposure/)

  Connect identity evidence and suspicious activity to containment, eradication, recovery, and post-incident review.

- [Cloud attack simulations cheat sheet](https://cybr.com/cheat-sheets/cloud-attack-simulations/)

  Explore adversary-emulation workflows for testing whether monitoring and response controls detect the expected behavior.

[Browse all cloud security cheat sheets](https://cybr.com/cheat-sheets/)

How the labs work

## Practice AWS defense without using your cloud account

Cybr prepares the AWS environment for each lab. You can focus on evidence, detections, and response instead of setup, billing, and cleanup.

1. Step 01

   ### Choose a defense lab

   Choose a monitoring, detection, hunting, or response scenario that matches your goals.

2. Step 02

   ### Launch the environment

   Get the AWS resources, telemetry, access, and instructions that the lab requires.

3. Step 03

   ### Complete the investigation

   Collect evidence, find suspicious activity, and apply the required response.

**Isolated AWS training environments**

Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs.

Continue with a structured path

## Build complete AWS detection and response skills

Use the Blue Team path for practical cloud defense. Use the Security Specialty path for broader AWS security coverage and exam preparation.

- [AWS Blue Team](https://cybr.com/learning-path/aws-blue-team-learning-path/)

  Build defensive skills in monitoring, threat detection, investigation, response, governance, and security automation.

- [AWS Certified Security Specialty](https://cybr.com/learning-path/aws-certified-security-specialty/)

  Study threat detection, incident response, security logging, monitoring, infrastructure defense, and data protection.

Go deeper with AWS security training

## Connect the labs with CloudTrail and incident response training

Learn how AWS records account activity, then use CloudTrail and Athena to investigate events and follow an incident response process.

[View the AWS CloudTrail course →](https://cybr.com/courses/beginners-guide-to-aws-cloudtrail-for-security/) [View the incident response course](https://cybr.com/courses/incident-response-with-cloudtrail-and-athena/)

Before you start

## AWS monitoring and detection lab FAQ

Do I need a Premium membership?

Yes. The featured monitoring and detection labs require Premium membership. The IAM credentials report lab in the skills list is free.

Do I need my own AWS account?

No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate.

How much AWS experience do I need?

Beginners can start with account evidence and guided log tasks. Later labs cover threat hunting, managed findings, containment, and automated response.

What monitoring and detection skills can I practice?

Labs cover CloudWatch, VPC Flow Logs, GuardDuty, Inspector, IAM reports, EventBridge, Lambda, AWS Config, Prowler, Steampipe, and incident response.

Can I safely investigate suspicious AWS activity?

Yes. Each scenario runs in an isolated training environment. You can inspect threats and apply response actions without risking production resources.

Will AWS charge me for the lab resources?

No. Cybr provides the AWS environment, covers its cloud costs, and removes the resources after your session.

## Start an AWS monitoring and detection lab

Build a CloudWatch security dashboard in a guided AWS environment, then continue through detection, investigation, and response scenarios.

[Start the CloudWatch lab →](https://cybr.com/hands-on-labs/lab/security-observability-with-cloudwatch-dashboards/) [Explore the AWS Blue Team path](https://cybr.com/learning-path/aws-blue-team-learning-path/)

Premium membership required