Skip to content
Cloud Provider Benchmarks

Cloud security & auditing

Cloud activity monitoring: how audit logs, alerts and metrics fit together

The difference between cloud audit logging, activity monitoring and performance monitoring, and how to build alerts on audit events across providers.

Published: Updated: Türkçe oku

Direct answer

Activity monitoring is built on audit logs: the provider records each management operation, and a monitoring layer filters those events, raises alerts on risky actions and supports investigation. Audit-logging services such as CloudTrail or vTrail are the event source, not the monitoring system itself.

Executive summary

Cloud activity monitoring means watching what identities do in a cloud account — creating, changing or deleting resources — and reacting to risky actions. Audit logs are its data source; alerting, correlation and investigation sit on top. It is distinct from performance monitoring, which tracks metrics such as CPU or latency. This article explains the layers, typical detections and how CloudTrail, PortvMind's vTrail, Google Cloud Audit Logs and the Azure Activity Log supply the underlying events.

Key findings

  1. 01 Audit logging records events; activity monitoring evaluates them; performance monitoring measures resource metrics. They are separate layers with separate tools.
  2. 02 High-value detections are few and well known: root or administrator logins, IAM policy changes, audit-log configuration changes, security-group openings and mass deletions.
  3. 03 Event-driven routing (EventBridge, Pub/Sub sinks, Event Hubs) lets detections run in near real time rather than in batch.
  4. 04 Where an audit service's export options are not documented, monitoring depends on the provider's own interface or on future integrations.

Three layers that are often confused

Layer Question it answers Typical data Examples
Audit logging Who did what, when, with what result? Identity-attributed API events CloudTrail, Cloud Audit Logs, Activity Log, vTrail
Activity monitoring Is anything risky happening right now? Filtered audit events, rules, alerts EventBridge rules, log-based alerts, SIEM detections
Performance monitoring Is the system healthy and fast? Metrics, traces, application logs CloudWatch metrics, Cloud Monitoring, Prometheus

Audit logging is the foundation: without a complete, trustworthy record of management activity there is nothing reliable to monitor.

What the event sources provide

Documented features of cloud audit logging services
Feature vTrail PortvMind Cloud AWS CloudTrail Amazon Web Services Azure Monitor Activity Log Microsoft Azure Cloud Audit Logs Google Cloud
Control-plane audit scope Records management operations (create, modify, delete) performed through the API or console. Yes Cloud management API operations. Yes Management events recorded by default. Yes Azure Resource Manager write/delete/action operations. Yes Admin Activity logs always enabled.
Identity attribution Identifies the authenticated user, project/account and scope behind each operation. Yes User ID, user name, project ID and auth scope. Yes userIdentity block (principal, account, session). Yes Caller and claims. Yes authenticationInfo.principalEmail.
Request metadata Captures request ID, HTTP method, path, status code, source IP and user agent. Yes Request ID, HTTP method, path, status, client IP, user agent, request time. Yes eventTime, requestID, sourceIPAddress, userAgent, errorCode. Partial Correlation ID, operation, status and caller IP in HTTP request details where available. Yes requestMetadata.callerIp and callerSuppliedUserAgent; status.
Data-plane (data access) events Optional recording of data-level reads and writes (for example object reads). Unverified Yes Data events (for example S3 object-level) are optional and charged. Partial Via resource logs and diagnostic settings, not the Activity Log itself. Yes Data Access logs, mostly disabled by default.
Event search and filtering Console or API search by user, time range, resource or operation. Unverified Yes Event history lookup; SQL queries in CloudTrail Lake. Yes Portal filtering and Log Analytics (KQL). Yes Logs Explorer and Log Analytics.
Configurable retention Documented default retention and options to extend it. Unverified Yes 90-day event history; longer retention via trails to S3 or CloudTrail Lake. Yes 90 days in the platform; longer through Log Analytics or Storage. Yes Admin Activity retained 400 days in _Required; other buckets configurable.
Export and streaming Delivery to object storage, log analytics or SIEM pipelines. Unverified Yes S3, CloudWatch Logs, EventBridge. Yes Diagnostic settings to Log Analytics, Storage and Event Hubs. Yes Sinks to Cloud Storage, BigQuery and Pub/Sub.
Log integrity validation Cryptographic or immutability controls that detect tampering. Unverified Yes Log file integrity validation with digest files. Partial Immutable storage policies on the export destination. Partial Locked log buckets prevent retention changes.
Pricing model Whether baseline audit history is included and how extended capabilities are charged. Unverified Yes Event history and one copy of management events free; data events and Lake charged. Yes 90-day Activity Log included; ingestion into Log Analytics is charged. Yes Admin Activity at no charge; Data Access ingestion charged beyond free allotment.
Information source Supplied by provider team Official documentation Official documentation Official documentation

The rows that matter most for monitoring are search, export and request metadata: an event that cannot be routed to a rule engine can only be inspected after the fact.

Detections worth building first

  1. Audit configuration changes — stopping, deleting or modifying a trail, sink or diagnostic setting.
  2. Identity and access changes — new administrator users, policy attachments, access keys created for privileged identities.
  3. Privileged sign-in — use of root or break-glass accounts.
  4. Network exposure — security-group or firewall rules opening management ports to 0.0.0.0/0.
  5. Destructive bursts — many delete operations from one identity in a short window.
  6. Unusual origin — successful API calls from new countries, ASNs or user agents.

Each of these maps to fields present in every audit format compared here: identity, operation, target, source IP and outcome.

Routing events to rules

  • AWS: CloudTrail delivers management events to EventBridge, where rules match event patterns and trigger notifications or automated responses.
  • Google Cloud: log sinks route audit entries to Pub/Sub; log-based metrics and alerting policies in Cloud Monitoring evaluate them.
  • Azure: activity-log alerts fire on specific operations; diagnostic settings stream events to Event Hubs for external SIEMs.
  • PortvMind: vTrail records management activity on PortvMind Cloud. How events are accessed and whether they can be exported to external rule engines is not yet publicly documented.

Retention for investigation

Monitoring catches events as they happen; investigation needs history. NIST SP 800-92 recommends retention periods driven by policy and regulation, and many frameworks require a year or more. Default retention is 90 days for CloudTrail event history and the Azure Activity Log and 400 days for Google Admin Activity logs, so export to long-term storage is usually required.

Methodology and limitations

Capabilities are assessed from documentation using the cloud auditing methodology. Detection guidance is general and not specific to any provider’s security tooling. vTrail information is provider-supplied.

Conclusion

Treat audit logs as the source of truth and activity monitoring as the layer that watches them. Choose providers whose audit service exposes events to your rule engine, start with a short list of high-signal detections, and keep history long enough to investigate what the alerts uncover.

Frequently asked questions

Is CloudTrail a monitoring tool?

CloudTrail is an audit-logging service. It becomes part of activity monitoring when its events are routed to CloudWatch, EventBridge or a SIEM that evaluates them and raises alerts.

What should I alert on first?

Changes to identity and access policies, changes that disable or alter audit logging, use of highly privileged accounts, network rules opened to the internet and unusual bulk deletions.

Does vTrail provide alerting?

vTrail is documented as an audit-logging service. Alerting and export integrations have not been publicly documented and are not claimed here.

Sources

  1. [1] AWS CloudTrail User Guide — AWS Official documentation accessed:
  2. [2] Cloud Audit Logs overview — Google Cloud Official documentation accessed:
  3. [3] Azure Monitor activity log — Microsoft Official documentation accessed:
  4. [4] NIST SP 800-92: Guide to Computer Security Log Management — NIST Official documentation accessed:
  5. [5] CIS Critical Security Controls — Audit Log Management — Center for Internet Security Secondary source accessed:
  6. [6] PortvMind Cloud — PortvMind Supplied by provider team accessed: