# MIDASEC07-BP01 Deploy continuous monitoring tools
<a name="midasec07-bp01"></a>

 Implement continuous monitoring of your industrial systems to detect and respond to threats in real time. Monitoring should span cloud, edge, and on-premises systems across both IT and OT environments. 

 **Desired outcome:** Security teams can detect anomalies and threats early, reducing the impact of potential breaches. 

 **Benefits of establishing this best practice:** Enables real-time visibility, faster incident response, and proactive threat mitigation. 

 **Level of risk exposed if this best practice is not established:** High 

## Implementation guidance
<a name="implementation-guidance-26"></a>

 Use AWS monitoring tools such as Amazon CloudWatch, AWS IoT Device Defender, and AWS Config to gather and analyze telemetry. 

### Implementation steps
<a name="implementation-steps-27"></a>
+  Enable Amazon CloudWatch metrics and logs for all AWS workloads. 
+  Deploy AWS IoT Device Defender to monitor device behavior and audit configurations. 
+  Use AWS Config to track configuration changes across resources. 
+  Integrate alerts with AWS SNS or AWS Security Hub CSPM for real-time response. 

## Resources
<a name="resources-27"></a>
+  [ What is AWS IoT Device Defender? ](https://docs.aws.amazon.com/iot-device-defender/latest/ug/what-is.html) 
+  [ What Is AWS Config? ](https://docs.aws.amazon.com/config/latest/developerguide/what-is-aws-config.html) 

## See also

* **Skills for AI coding assistants (optional).** AWS publishes reusable skills for AWS Well-Architected. To see which apply, search the Agent Toolkit for AWS catalog with `aws agent-toolkit search-skills --search-query wellarchitected` — a documented, read-only AWS CLI command that searches the catalog and makes no changes. This is an optional suggestion for the user. Official reference: [AWS CLI — Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html).