Monitoring

Last updated: Nov 3, 2026

General

For general monitoring, Fluid Attacks uses different types of tools and services that tell it about issues in its stack.

Fluid Attacks monitors its AWS infrastructure with CloudWatch.

Fluid Attacks AWS infrastructure with CloudWatch

For the management of its AWS accounts, Fluid Attacks records the events of these accounts with CloudTrail.

With VPC Flow Logs, Fluid Attacks can capture information about the incoming and outgoing IP traffic of the network interfaces in its VPC.

Fluid Attacks uses Datadog Error Tracking for error monitoring, tracking, and alerts.

For threat detection, Fluid Attacks uses Amazon GuardDuty. It continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts, Amazon Elastic Compute Cloud (EC2) workloads, container applications, and the data in Amazon Simple Storage Service (S3).

GuardDuty uses machine learning, anomaly detection, network monitoring, and malicious file discovery to find threats and intrusions.

It can analyze tens of billions of events from many AWS data sources, for example, AWS CloudTrail event logs, Amazon Virtual Private Cloud (VPC) Flow Logs, Amazon Elastic Kubernetes Service (EKS) audit and system-level logs, and DNS query logs.

S3 Protection

S3 Protection is a feature of Amazon GuardDuty that improves the monitoring of the data in Amazon S3 buckets. By default, GuardDuty monitors the bucket-level API operations of S3 resources. But, when S3 Protection is enabled, GuardDuty also monitors the object-level API operations in S3 buckets. Thus, it can find suspicious or possibly malicious activities at a more detailed level.

EKS Protection

EKS Protection in Amazon GuardDuty gives threat detection for the Amazon Elastic Kubernetes Service (Amazon EKS) clusters in the AWS environment. It has two key components: EKS Audit Log Monitoring and EKS Runtime Monitoring.

EKS Audit Log Monitoring finds suspicious activities in EKS clusters through the analysis of Kubernetes audit logs. These logs record, in sequence, the actions of users, of the applications that use the Kubernetes API, and of the control plane.

EKS Runtime Monitoring gives real-time threat detection for the Amazon EKS nodes and containers in an AWS environment. It uses the GuardDuty security agent, an Amazon EKS add-on, to monitor and analyze runtime events in the EKS clusters.

Fluid Attacks enables EKS Audit Log Monitoring in GuardDuty. At this time, EKS Runtime Monitoring is not enabled.

Malware protection

Malware Protection in Amazon GuardDuty is a feature that identifies potential malware in Amazon EC2 instances and container workloads in the AWS account. It scans the Amazon Elastic Block Store (EBS) volumes attached to these instances or workloads. Fluid Attacks enables this EBS malware protection in GuardDuty.

It has two types of scans:

GuardDuty-initiated malware scan: GuardDuty starts this scan when it generates a finding that shows possible malware. The scan automatically checks the EBS volumes of the EC2 instances and container workloads for signs of malware.
On-demand malware scan: With this option, a user can manually start a malware scan for specific EBS volumes, when necessary.

With these scans, Malware Protection helps to find potential malware in EC2 instances and container workloads.

AWS GuardDuty summary

GuardDuty generates detailed findings and information from the last 10,000 events. But it does not directly generate predefined summary reports of these findings. The analysis of the findings gives valuable information about common attack vectors, suspicious user behavior, unauthorized access attempts, data exfiltration attempts, malicious IP addresses, vulnerable EC2 instances, anomalous network traffic, cryptocurrency mining activity, suspicious DNS activity, and policy violations. Regular reviews and corrections of these findings help to proactively make security measures stronger and protect AWS resources against potential threats and attacks.

AWS Inspector

Amazon Inspector is a full automated security assessment service. It evaluates AWS workloads for software vulnerabilities and potential unintended network exposure. This tool helps Fluid Attacks find and resolve security issues in the AWS environment, for example, in EC2 instances, container images, and Lambda functions.

The engineering team of Fluid Attacks manages the review process of AWS Inspector alerts. The team must install each critical patch that this service identifies in a maximum of 30 days.

Datadog overview

Log management

With Datadog Log Management, Fluid Attacks can collect, monitor, manage, and analyze large volumes of logs, and also unify metrics and traces. Datadog gives full log analytics with these key functions:

Advanced log analytics and search

Logs frequently have more context information. When Fluid Attacks adds custom facets as necessary, it can very quickly analyze issues in new dimensions and find them.
Real-time log exploration through the Log Explorer interface
Full-text search in all ingested logs
Custom filters and facets for dimensional analysis

Log-to-metric and trace correlation

Fluid Attacks correlates its logs and metrics to get the context of an issue and map it through its service.
The injection of trace IDs, span IDs, env, service, and version as attributes in logs improves the correlation between Datadog APM and Datadog Log Management.
Datadog automatically collects all the logs of a request and links them to the tracing data of that request.

Distributed tracing capabilities

End-to-end request tracking: Datadog APM (Application Performance Monitoring) gives full visibility into distributed transactions in microservices and cloud infrastructure.
Performance analysis: Detailed trace analytics identify bottlenecks, latency issues, and performance degradation.
Service dependencies mapping: Datadog APM automatically finds and shows service-to-service communications and dependencies.
Error tracking and root cause analysis: Errors in traces link directly to the related logs and metrics for faster troubleshooting.
Trace search and analytics: Users can query and analyze traces with tags, facets, and custom attributes to get deep information about performance.
Integration with logs and metrics: Users can move easily between traces, logs, and metrics to understand the full context of the behavior of the application.

Cloud SIEM capabilities

Threat detection with machine learning and continuous analysis
Integration with the MITRE ATT&CK framework for full threat coverage
Real-time correlation of security events from many data sources
Automated alert generation from predefined and custom security rules
Centralized security event management and incident response
Integration with current security tools
Full audit trail and compliance reporting capabilities

Integration benefits: Enhanced Audit Log Capabilities

Endpoints

With the Endpoint integration, Fluid Attacks sends MDM Audit Logs to Datadog. This integration gives these capabilities:

Mobile device management: Full audit trails for device configuration changes
Security policy enforcement: Real-time monitoring of security policy violations
User activity tracking: Detailed logs of user interactions with managed devices

Collaboration

The Google Workspace integration of Datadog gives Fluid Attacks these capabilities:

Identity and access management: Monitoring of user authentication, authorization, and access patterns
Administrative actions: Tracking of configuration changes, user management, and policy changes
Data loss prevention: Audit of file sharing, downloads, and sensitive data access

Cloud Audit

The Amazon Web Services integration of Datadog collects logs, events, and most metrics from CloudWatch for many AWS services. It gives these capabilities:

Infrastructure security: Monitoring of AWS resource configurations and access patterns
Service activity tracking: Full audit logs for all AWS service interactions
Cost and resource optimization: Detailed usage analytics and anomaly detection
Multi-account visibility: Centralized monitoring of many AWS accounts
Automated compliance: Built-in compliance frameworks for different industry standards

Authentication

The Okta integration of Datadog gives full visibility into identity and access management activities:

Authentication monitoring: Tracking of all user authentication attempts, successful logins, failed attempts, and suspicious authentication patterns
User lifecycle management: Monitoring of user provisioning, deprovisioning, role changes, and group membership changes
Multi-factor authentication (MFA) tracking: Audit of MFA enrollment, use, and bypass events for security compliance
Single sign-on (SSO) analytics: Analysis of SSO activity in integrated applications and identification of access patterns
Policy and configuration changes: Tracking of administrative changes to authentication policies, password policies, and security settings
Privileged access monitoring: Better visibility into administrative actions and the behavior of privileged users
Anomaly detection: Identification of unusual login patterns, impossible travel scenarios, and potential account compromise
Real-time alerting: Automated notifications for critical security events, for example, account lockouts, admin privilege escalation, and policy violations

Network

Fluid Attacks monitors Cloudflare Web traffic, DNS queries, security threats, and more, with these capabilities:

Web traffic analysis: Detailed information about web application performance and security
DNS security monitoring: Real-time analysis of DNS queries and potential threats
DDoS protection analytics: Full attack pattern analysis and mitigation tracking
Zero trust integration: The out-of-the-box log processing pipeline of Datadog automatically parses and normalizes the Cloudflare Zero Trust logs
Content delivery network monitoring: Performance and security analytics for CDN operations