Cloud Logging for Security and Beyond
Summary: Unit 42 outlines a cloud logging framework for organizations running on AWS, Azure and GCP, noting that control plane logging exists by default on each provider while data plane logging does not. The article describes how business impact analyses, regulatory frameworks such as GDPR, HIPAA and PCI, and security monitoring needs should drive which logs are ingested and retained, citing the JavaGhost group's use of compromised cloud environments for phishing infrastructure as a case where control plane audit logs show the build-out but data plane logs are needed to detect the emails sent.
What you should know: JavaGhost's phishing infrastructure is visible in control plane audit logs, but the phishing emails sent from compromised resources only appear if data plane logging is turned on - and data plane logging is off by default on every major provider.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026