When you run five or more ECS instances, we recommend that you use Simple Log Service (SLS) to centrally collect business logs and monitor for anomalies.
Scenarios
If you have five or more ECS instances, use SLS to centrally collect business logs from all instances.
Threat level
Default threat level: Low.
You can change the threat level based on your business requirements.
Detection logic
Checks whether SLS is used to centrally collect business logs and monitor for anomalies when you have five or more ECS instances.
Rule details
|
Parameter |
Description |
|
Rule name |
Use Simple Log Service to centrally collect and monitor business logs |
|
Rule identifier |
|
|
Automatic remediation |
Not supported |
|
Rule trigger |
24-hour epoch |
|
Supported resource types |
ACS::::Account |
|
Input parameters |
None |