GravityLog — Cloud Security Logging Mapper

Cloud Logging Catalog

What each cloud security log actually captures, whether it's on by default, how long it's kept before it's gone for good, and which frameworks it supports.

Scope: This is a reference catalog and manual assessment aid, not a connected cloud scanner — nothing here reads your actual cloud accounts. Microsoft Azure is covered in depth (11 sources); AWS now covers CloudTrail, VPC Flow Logs, GuardDuty, Route 53 Resolver query logging, AWS Config, EKS, and AWS WAF (8 sources) and is still growing. Assessment status is saved only in this browser.

What this tool is for: It answers "what should I be logging, and why" — not "am I compliant." A log source being enabled is evidence a control is supportable, never proof that a framework requirement is fully met. Configuration, delivery, and evidence quality are three different questions; this catalog only speaks to the first with any confidence.

Pick a standard to see which cataloged cloud logs support each of its controls, and why. Only controls with at least one supporting log in this catalog are listed — a control missing here means no cataloged log supports it yet, not that the cloud can't evidence it. Supporting a control is not the same as meeting it: that depends on how the log is configured, collected, retained, and reviewed.