Question

A security team monitors an application that writes structured JSON logs to a CloudWatch Logs group. Application error volume fluctuates significantly by time of day and day of week, so a static threshold alarm on the error count either fires constantly during peak hours or misses spikes during off-peak hours. The team wants an alerting approach that automatically adapts to the normal daily and weekly patterns of the error metric and only alarms on statistically unusual deviations, with minimal ongoing tuning. Which approach best meets this requirement?

Accepted Answer

Create a metric filter to extract the error count into a custom metric, then create a CloudWatch alarm that uses anomaly detection on that metric and alarms when values fall outside the anomaly detection band.

Answer

Create a metric filter to extract the error count, then create a static-threshold alarm and manually adjust the threshold each week based on observed peaks.

Answer

Stream the log group to Amazon S3 via Kinesis Data Firehose and run scheduled Athena queries that compare current error counts to a fixed limit.

Answer

Create a composite alarm that combines multiple static-threshold alarms so that different thresholds apply based on the time of day.