Severity : High
Description : Sending CloudTrail logs to CloudWatch is only useful if metrics are setup to detect risky activity from those logs. There are numerous metrics that should be used. For the exact filter patterns, please see this plugin on GitHub: https://github.com/cloudsploit/scans/blob/master/monitoringMetrics.
Remediation Steps : Enable metric filters to detect malicious activity in CloudTrail logs sent to CloudWatch.