github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/avd_docs/aws/cloudwatch/AVD-AWS-0151/Management_Console.md (about)

     1  **To create a metric filter and alarm**
     2  
     3  1.  Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/)
     4  
     5  1.   In the navigation pane, choose **Log groups**.
     6      
     7  1.   Select the check box for the CloudWatch Logs log group that is associated with the CloudTrail trail that you created.
     8      
     9  1.   From **Actions**, choose **Create Metric Filter**.
    10      
    11  1.   Under **Define pattern**, do the following:
    12      
    13          a.  Copy the following pattern and then paste it into the **Filter Pattern** field.
    14          
    15              {($.eventName=CreateTrail) || ($.eventName=UpdateTrail) || ($.eventName=DeleteTrail) || ($.eventName=StartLogging) || ($.eventName=StopLogging)}
    16          
    17          b.  Choose **Next**.
    18          
    19  1.   Under **Assign metric**, do the following:
    20      
    21          a.  In **Filter name**, enter a name for your metric filter.
    22          
    23          b.  For **Metric namespace**, enter `LogMetrics`.
    24          
    25          If you use the same namespace for all of your CIS log metric filters, then all CIS Benchmark metrics are grouped together.
    26          
    27          c.  For **Metric name**, enter a name for the metric. Remember the name of the metric. You will need to select the metric when you create the alarm.
    28          
    29          d.  For **Metric value**, enter `1`.
    30          
    31          e.  Choose **Next**.
    32          
    33  2.   Under **Review and create**, verify the information that you provided for the new metric filter. Then choose **Create metric filter**.
    34      
    35  3.   Choose the **Metric filters** tab, then choose the metric filter that you just created.
    36      
    37          To choose the metric filter, select the check box at the upper right.
    38      
    39  4.   Choose **Create Alarm**.
    40      
    41  5.   Under **Specify metric and conditions**, do the following:
    42      
    43          a.  Under **Metric**, leave the default values. For more information about the available statistics, see [Statistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html#Statistic) in the _Amazon CloudWatch User Guide_.
    44          
    45          b.  Under **Conditions**, for **Threshold**, choose **Static**.
    46          
    47          c.  For **Define the alarm condition**, choose **Greater/Equal**.
    48          
    49          d.  For **Define the threshold value**, enter `1`.
    50          
    51          e.  Choose **Next**.
    52          
    53  6.   Under **Configure actions**, do the following:
    54      
    55          a.  Under **Alarm state trigger**, choose **In alarm**.
    56          
    57          b.  Under **Select an SNS topic**, choose **Select an existing SNS topic**.
    58          
    59          c.  For **Send a notification to**, enter the name of the SNS topic that you created in the previous procedure.
    60          
    61          d.  Choose **Next**.
    62          
    63  7.   Under **Add name and description**, enter a **Name** and **Description** for the alarm. For example, `CIS-3.5-CloudTrailChanges`. Then choose **Next**.
    64      
    65  8.   Under **Preview and create**, review the alarm configuration. Then choose **Create alarm**.