mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 10:23:16 +00:00
67f4ca81d9
The cis-UnauthorizedAPICalls alarm fired on a single breaching 5-min period (1/1), so any CloudFormation/CDK deploy burst of benign describe-API denials or a one-off console fat-finger paged and self-recovered, producing notification storms (~17 flips on 2026-06-10). Require 3 consecutive breaching periods so only sustained unauthorized activity alarms; CIS detection of a real persistent problem is preserved (detection window up to ~15 min). Per-control override so the other 14 CIS alarms keep their 1/1 sensitivity (templates untouched). GPT-4.1 cross-review: no blockers (documentation FIX noted re: detection latency). |
||
|---|---|---|
| .. | ||
| account-baseline-stack.ts | ||
| backup-offsite-stack.ts | ||
| backup-stack.ts | ||
| bedrock-logging-regional.ts | ||
| bedrock-logging.ts | ||
| cis-monitoring.ts | ||
| detective-controls.ts | ||
| dynamodb-cmk-stack.ts | ||
| flow-logs.ts | ||
| governance-toggles.ts | ||
| logs-key.ts | ||
| regional-baseline-stack.ts | ||
| ses-monitoring.ts | ||
| web-acl.ts | ||