Rule: At Least One Enabled Trail Should Be Present in a Region

Rule Description:

Troubleshooting Steps:

2. 1.
   Check if CloudTrail is enabled in the desired region by logging in to the AWS Management Console.
4. 2.
   Go to the CloudTrail service and select the appropriate region from the top-right corner.
6. 3.
   Ensure that there is an enabled trail present for the region and that it is actively logging events.
8. 4.
   If no trail is present or the existing trail is not enabled, follow the remediation steps below.

Remediation Steps:

AWS Management Console:

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the CloudTrail service.
6. 3.
   Click on the "Trails" option from the left-hand menu.
8. 4.
   Click the "Create trail" button.
10. 5.
    Enter a name for the trail (e.g., "CSF Trail") and optionally provide a description.
12. 6.
    Select the appropriate region from the dropdown menu.
14. 7.
    Choose the desired storage location for the CloudTrail logs (S3 bucket).
16. 8.
    Configure additional settings as per your requirements (e.g., log file validation, encryption, etc.).
18. 9.
    Enable the trail by checking the "Enable CloudTrail" checkbox.
20. 10.
    Select the desired management events and data events that you want to include in the trail.
22. 11.
    Review the settings and click on the "Create trail" button to create and enable the CloudTrail trail.

AWS CLI:

2. 1.
   Install or update the AWS CLI to the latest version.
4. 2.
   Open a terminal or command prompt.
6. 3.
   Run the following command to create a new trail:

aws cloudtrail create-trail --name CSF_Trail --s3-bucket-name <your_s3_bucket_name> --region <desired_region> --is-multi-region-trail

2. 1.
   Enable the trail using the following command:

aws cloudtrail start-logging --name CSF_Trail

<your_s3_bucket_name>

<desired_region>

Verification:

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the CloudTrail service.
6. 3.
   Select the appropriate region from the top-right corner.
8. 4.
   Locate the trail created in the remediation steps or confirm that an existing trail is enabled.
10. 5.
    Check the trail status, which should be "Logging" if events are being properly logged.
12. 6.
    Review the CloudTrail events to ensure that they are capturing the necessary information.