# SEC04: How do you detect and investigate security events?

## References

- [AWS SEC04](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec-04.html)

## Date

2025-11-27

## Focus Area

Detection

## Tổng quan

SEC04 tập trung vào detecting và investigating security events.

## Best Practices

| BP | Name | Description |
|----|------|-------------|
| [SEC04-BP01](SEC04-BP01-Configure-Logging.md) | Configure logging | Enable logging cho tất cả services |
| [SEC04-BP02](SEC04-BP02-Centralized-Logging.md) | Centralized logging | Capture logs in standardized locations |
| [SEC04-BP03](SEC04-BP03-Correlate-Alerts.md) | Correlate alerts | SIEM correlation |
| [SEC04-BP04](SEC04-BP04-Auto-Remediation.md) | Auto-remediation | Initiate remediation automatically |

## Checklist

- [ ] Logging enabled
- [ ] Centralized log storage
- [ ] SIEM configured
- [ ] Alerts correlated
- [ ] Auto-remediation implemented
