---
title: Unauthorized API calls should be monitored
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Unauthorized API calls should be
  monitored
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Unauthorized API calls should be monitored
 
## Description{% #description %}

AWS accounts should have at least one active multi-region CloudTrail trail that captures all management events (an event selector with `IncludeManagementEvents` set to true and `ReadWriteType` set to `All`) and sends logs to CloudWatch Logs, with a metric filter and alarm for unauthorized API calls. The alarm must notify an SNS topic with at least one confirmed subscriber so that unauthorized activity is detected and acted on quickly.

## Remediation{% #remediation %}

1. Create a metric filter on the trail's CloudWatch Logs log group using the pattern `{ ($.errorCode ="*UnauthorizedOperation") || ($.errorCode ="AccessDenied*") && ($.sourceIPAddress!="delivery.logs.amazonaws.com") && ($.eventName!="HeadBucket") }`, as described in [Creating CloudWatch alarms for CloudTrail events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html).
1. Create an SNS topic with at least one confirmed subscription, then create a CloudWatch alarm on the filter's metric (for example, `Sum` over 300 seconds, threshold `>= 1`) with the SNS topic as its alarm action, following [Subscribing an endpoint to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html).

## References{% #references %}

- [Creating metrics from log events using filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html)
- [Subscribing an endpoint to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)