AWS Config Logging Disabled
Looking for changes of remiving the delivery channel or configuration recorder for AWS Config. Indicative of defense evasion or someone covering their tracks. This would stop all data such as configuration snapshots and rule compliance notifications from getting to the S3 bucket/SNS topic. Note: Before you can delete a delivery channel, you must first stop the customer-managed configuration recorder
Splunk (SPL)
