Cis AWS Euc 4.4

Utilize site wide activity feed for monitoring (Manual)

Profile Applicability

• Level 1

Description

Admins can view and export the activity feed for an entire WorkDocs site.

Rationale

WorkDoc admins should monitor and export activity feeds for the site as record of activity. These activity reports should be reviewed every month for any abnormalities and rotated every 90 days.

Impact

To use this feature, you must first install the Amazon WorkDocs Companion.

Audit Procedure

Perform the steps below to view site-wide activity feed.

Using WorkDocs Web Application

1. Click Activity feed
2. Click Filter, then Click Site-wide activity
3. Select Activity Type filters and choose Date Modified settings as needed, then click Apply
4. When the filtered activity feed results appear, search by file, folder, or user name to narrow your results. You can also add or remove filters as needed

Using AWS Console

Not applicable - must be accessed via WorkDocs web application.

Expected Result

Site-wide activity feed is being monitored and exported regularly.

Remediation

Using WorkDocs Web Application

Perform the following steps to Export site-wide activity feed:

1. Click Activity feed
2. Click Filter, then Click Site-wide activity
3. Select Activity Type filters and choose Date Modified settings as needed, then click Apply
4. When the filtered activity feed results appear, search by file, folder, or user name to narrow your results. You can also add or remove filters as needed
5. Click Export
6. Export the activity feed as a .csv or .json file. Any filters you applied are reflected in the exported file

Using AWS CLI

Not applicable - must be configured via WorkDocs web application.

Default Value

By default, site wide monitoring is not enabled and requires additional configuration to enable the feature.

References

1. https://docs.aws.amazon.com/workdocs/latest/adminguide/site-activity.html
2. https://amazonworkdocs.com/apps.html
3. https://docs.aws.amazon.com/workdocs/latest/userguide/activity_feed.html
4. https://docs.aws.amazon.com/workdocs/latest/adminguide/site-activity.html

CIS Controls

v8:

• 8.2 Collect Audit Logs
  • Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.

v7:

• 6.2 Activate audit logging
  • Ensure that local logging has been enabled on all systems and networking devices.

Profile

Level 1