Monitorización de seguridad y detección de amenazas con AWS
•Transferir como PPTX, PDF•
0 gostou•265 visualizações
The document discusses Amazon Web Services (AWS) security services including AWS CloudTrail, VPC Flow Logs, Amazon CloudWatch, Amazon GuardDuty, AWS Security Hub, and Amazon Detective. It provides overviews and descriptions of the features and capabilities of these services for monitoring, detecting threats, aggregating findings, and investigating security issues on AWS.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Monitorización de seguridad y detección de amenazas con AWS
Semelhante a Monitorización de seguridad y detección de amenazas con AWS (20)
Mais de javier ramirez
Mais de javier ramirez (20)
Último
Último (20)
Monitorización de seguridad y detección de amenazas con AWS
- 1. © 2020, Amazon Web Services, Inc. or its Affiliates. Esteban Hernández Specialist Solutions Architect Security & Compliance @gamabuntasama Security monitoring andThreat detection Javier Ramirez Developer Advocate @supercoco9
- 2. © 2020, Amazon Web Services, Inc. or its Affiliates. Protect Detect Respond Automate Investigate RecoverIdentify AWS Systems Manager AWS Config AWS Lambda Amazon CloudWatch Amazon Inspector Amazon Macie Amazon GuardDuty AWS Security Hub AWS IoT Device Defender AWS KMSIAM AWS Single Sign-On Snapshot Archive AWS CloudTrail Amazon CloudWatch Amazon VPC AWS WAF AWS Shield AWS Secrets Manager AWS Firewall Manager AWS Personal Health Dashboard Amazon Route 53 AWS Direct Connect AWS Transit Gateway AWS PrivateLink AWS Step Functions Amazon Cloud Directory AWS CloudHSM AWS Certificate Manager AWS Control Tower AWS Service Catalog AWS Well- Architected Tool AWS Trusted Advisor AWS Resource Access Manager AWS Directory Service Amazon Cognito Amazon S3 Glacier AWS Security Hub AWS Systems Manager AWS CloudFormation AWS OpsWorks Amazon Detective AWS Organizations AWS foundational and layered security services Threat management services
- 3. © 2020, Amazon Web Services, Inc. or its Affiliates. Log sources
- 4. © 2020, Amazon Web Services, Inc. or its Affiliates. Different log sources AWS Managed Service Logs System Logs Application Logs
- 5. © 2020, Amazon Web Services, Inc. or its Affiliates. Overview of log delivery Collect Buffer Aggregate Transform Store
- 6. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS CloudTrail What is it? • A service that enables governance, compliance, and operational and risk auditing of your AWS account • With CloudTrail, you can capture and log events related to API calls and account activity events across your AWS infrastructure and resources • Simplify your compliance audits by automatically recording and storing activity logs for your AWS account • Increase visibility into your user and resource activity • Discover and troubleshoot security and operational issues by capturing a comprehensive history of changes that occurred in your AWS account What can you do? You define anAmazon S3 bucket for storage Account event occurs generating API activity CloudTrail captures and records the API activity A log of API calls is delivered to an S3 Bucket and optionally delivered to CloudWatch Events and CloudWatch Logs
- 7. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS CloudTrail Features • CloudTrail enables analysis of operational and security issues by providing visibility into API and event activity in your AWS account. • Key features include: • Management Event and Data Event logging • S3 log delivery • log file encryption • integrity validation • SNS notification • Cross-account S3 delivery • CloudWatch Logs integration • CloudWatch Events integration • Personal Health Dashboard integration • Ability to apply a trail to all regions (applies to new future regions) • Event filters for read/write event actions
- 8. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS CloudTrail Who? When? What? Where to? Where from? Bill 3:27pm Launch Instance us-west-2 72.21.198.64 Alice 8:19am Added Bob to admin group us-east-1 127.0.0.1 Steve 2:22pm Deleted DynamoDB table eu-west-1 205.251.233.176
- 9. © 2020, Amazon Web Services, Inc. or its Affiliates. VPC Flow Logs • Agentless • Enable per ENI, per subnet, or perVPC • Logged to AWS CloudWatch Logs • Create CloudWatch metrics from log data • Alarm on those metrics AWS account Source IP Destination IP Source port Destination port Interface Protocol Packets Bytes Start/end time Accept or reject
- 10. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon CloudWatch Amazon CloudWatch is a monitoring service for AWS cloud resources, applications you run on AWS and onPrem. Monitor EC2SpotTrends Monitor Other Resources Set Alarms - Events Monitor Custom Metrics Monitor & Store Logs Create Dashboards Take automated action Troubleshoot Metrics on Logs Centralize monitoring Operational Status
- 11. © 2020, Amazon Web Services, Inc. or its Affiliates. Why CloudWatch ? Monitor ActAnalyze • Metrics on resources • Observe app & Infra. health • Monitor custom metrics • Collect and monitor log files • Alarm on metrics and custom metrics • Take automated actions on alarms • Event drive corrective action • Visualization through dashboards • Unified opps. view • Extended retention if desired >
- 12. © 2020, Amazon Web Services, Inc. or its Affiliates. Log analytics flow Data Producers Collection Permanent cold storage Transformation Analysis and reporting
- 13. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon GuardDuty
- 14. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon GuardDuty: Data sources VPC Flow Logs VPC Flow Logs do not need to be turned on to generate findings; data is consumed through an independent duplicate stream Provides information about network communications for threat intel and behavioral detections DNS logs DNS logs are based on queries made from Amazon EC2 instances to known and unknown questionable domains DNS logs are additional to Amazon Route 53 query logs; Route 53 is not required for GuardDuty to generate DNS-based findings AWS CloudTrail events AWS CloudTrail provides a history of AWS API calls used to access the AWS ManagementConsole, SDKs, AWS Command Line Interface (AWS CLI), etc. Identifies user and account activity, including source IP address used to make the calls
- 15. © 2020, Amazon Web Services, Inc. or its Affiliates. How Amazon GuardDuty works VPC Flow Logs DNS logs AWS CloudTrail events FindingsData sources Threat intelligence Anomaly detection (ML) AWS Security Hub • Remediate • Partner solutions • Send to SIEM Amazon CloudWatch Event Finding types Examples Bitcoin mining C&C activity Unusual user behavior Examples • Launch instance • Change in network permissions Amazon GuardDuty Threat detection types HIGH MEDIUM LOW Unusual traffic patterns Example • Unusual ports and volume Amazon S3 bucket
- 16. © 2020, Amazon Web Services, Inc. or its Affiliates. What can Amazon GuardDuty detect? GuardDuty leverages threat intelligence from various sources • AWS security intel • AWS Partner Network (APN) Partners CrowdStrike and Proofpoint • Customer-provided threat intel Threat intelligence enables GuardDuty to identify the following: • Known malware-infected hosts • Anonymizing proxies • Sites hosting malware and hacker tools • Cryptocurrency mining pools and wallets Detecting known threats using threat intelligence
- 17. © 2020, Amazon Web Services, Inc. or its Affiliates. Unknown threats using machine learning Algorithms to detect unusual behavior • Inspecting signal patterns for heuristics • Profiling normal behavior and looking at deviations • Using machine learning classifiers
- 18. © 2020, Amazon Web Services, Inc. or its Affiliates. Reviewing findings: GuardDuty console
- 19. © 2020, Amazon Web Services, Inc. or its Affiliates. Reviewing findings: Details of API/JSON findings AWS Management Console API/JSON format Threat information • Severity • Region • Count/Frequency • Threat type • Affected resource • Source information • Viewable via Amazon CloudWatch Events
- 20. © 2020, Amazon Web Services, Inc. or its Affiliates. Reviewing findings: CloudWatch Events • GuardDuty aggregates all changes to findings that take place in five-minute intervals into a single event • CloudWatch Events can be graphed, stored, exported, and further analyzed Example: GuardDuty-related CloudWatch Event
- 21. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon CloudWatch CloudWatch Event Report Take action Amazon GuardDuty Detect Acting on findings
- 22. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS Security Hub
- 23. © 2020, Amazon Web Services, Inc. or its Affiliates. Enable AWS Security Hub for all your accounts Account 1 Account 2 Account 3 Conduct automated compliance scans and checks Take action based on findings. Continuously aggregate and prioritize findings Better visibility into security issues Easier to stay in compliance Introduction to AWS Security Hub
- 24. © 2020, Amazon Web Services, Inc. or its Affiliates. Avoid the use of the "root" account Ensure CloudTrail is enabled in all Regions Ensure no security groups allow ingress from 0.0.0.0/0 to port 22 Ensure IAM policies that allow full "*:*" administrative privileges are not created Examples 43 preconfigured rules for CIS Compliance standards
- 25. © 2020, Amazon Web Services, Inc. or its Affiliates. Compliance standards
- 26. © 2020, Amazon Web Services, Inc. or its Affiliates. Aggregated findings
- 27. © 2020, Amazon Web Services, Inc. or its Affiliates. Insights help identify resources that require attention
- 28. © 2020, Amazon Web Services, Inc. or its Affiliates. • Dashboard provides visibility into the top security findings • 20 pre-built insights provided by AWS and APN Partners • Customers can create their own insights • Examples Dashboard Amazon EC2 instances that have missing security patches Amazon S3 buckets with stored credentials Amazon S3 buckets with public read and write permissions Top AMIs by counts of findings 20 pre-built insights AWS Security Hub insights
- 29. © 2020, Amazon Web Services, Inc. or its Affiliates. Taking action on findings AWS Security Hub Amazon CloudWatch Events Amazon GuardDuty Amazon Inspector Amazon Macie Third-party providers
- 30. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon Detective
- 31. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon Detective Quickly analyze, investigate, and identify the root cause of security issues Built-in data collection Automated analysis Visual insights
- 32. © 2020, Amazon Web Services, Inc. or its Affiliates. How does Amazon Detective work?
- 33. © 2020, Amazon Web Services, Inc. or its Affiliates. Easy-to-use visualizations Faster and more effective investigations Ability to save time and effort with continuous data updates Amazon Detective: Key benefits
- 34. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon Detective: Sample use cases Incident investigation
- 35. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon Detective:Workflow integration SIEM/alert console Orchestration/ticketing system
- 36. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon Detective: Integrations and managed services APN Partners
- 37. © 2020, Amazon Web Services, Inc. or its Affiliates. Gracias Síguenos en twitter: https://twitter.com/awscloud_es Webinars y eventos: https://aws.amazon.com/es/about-aws/events/eventos-es/ Contacto: https://aws.amazon.com/es/contact-us/ Noticias y novedades: https://aws.amazon.com/es/new No olvides rellenar la encuesta para ayudarnos a mejorar Esteban Hernández Specialist Solutions Architect Security & Compliance @gamabuntasama Javier Ramirez Developer Advocate @supercoco9
Notas do Editor
- Identify Protect Detect Respond Recover CloudFormation, OpsWorks, - recovery is not just about the data, but also the ability to recover their entire infrastructure and apps extremely fast.
- Integrity validation uses Who changed what, when, and using what credentials?
- How does Integrity Validation work? CloudTrail creates a digest file, when it delivers new logs into your Amazon S3 Bucket CloudTrail uses a private key per-region to cryptographically sign the digest file Customers can use a public key, that correlates to the private key, to validate signatures SNS notifications when new CloudTrail log files are delivered to Amazon S3 Bucket
- Who made the API call? When was the API call made? What was the API call? Which resources were acted up on in the API call? Where was the API call made from and made to? Stored durably in S3 Discuss ways to consume CloudTrail logs (Console, CLI, Splunk, SumoLogic, AlertLogic, Loggly, DataDog, etc.)
- No Agents! Just Turn it on. No really, Ill wait. Enable per ENI, per Subnet or per VPC All network traffic data is logged to CloudWatch logs so you get durable storage but also all the analysis features such as filter queries and metric creation And then Create Alarms on those metrics Collected, processed and stored in ~10 minute capture windows into Cloudwatch Logs
- Amazon CloudWatch is a monitoring service for AWS cloud resources and the applications you run on AWS and OnPrem. You can use Amazon CloudWatch to collect and track metrics, collect and monitor log files, set alarms, and automatically react to changes in your AWS resources. Amazon CloudWatch can monitor AWS resources such as Amazon EC2 instances, Amazon DynamoDB tables, and Amazon RDS DB instances etc, as well as custom metrics generated by your applications and services, and any log files your applications generate. You can use Amazon CloudWatch to gain system-wide visibility into resource utilization, application performance, and operational health. You can use these insights to react and keep your application, infrastructure and operations running smoothly. At a high-level CloudWatch allows to: Spot Trends Centralize Monitoring Troubleshoot Create Metrics on Logs to evaluate behavior Take automated action with event and alarms And have a operational status view through dashboards.
- Data Sources GuardDuty analyzes AWS VPC Flow Logs, DNS and CloudTrail Events. It is optimized to consume large volumes of. AWS does all of the heavy lifting you are not required to turn on any logging. Data is NOT stored by GuardDuty – It is pulled from internal sources, analyzed in memory and then discarded. GuardDuty ONLY stores the results from the findings that are produced. Thus your data remains your data Click
- With threat intel being applied to data sources Guard Duty can detect known threats and produce instant findings (they are known !). Things like (READ bottom of slide) Threat Intel comes from: AWS Security Intel – GuardDuty has access to AWS’ own security intel feed (from ASIS team). This is the only way you can access this feed. This Intel is constantly being updated by AWS Security team. Commercial/partner Intelligence is currently provided by CrowdStrike and ProofPoint. At no extra cost to the customer. Customer’s can provide there own Threat Intelligence data and customer provided threat intel does not get shared across customers. What Else can GD detect…
- Discuss Training periods – don’t try to test these For detecting unknown threats GuardDuty incorporates a heuristic or anomaly based technique that builds profiles of "normal" behavior and then looks for deviations from that normal behavior. This is done using very simplistic state-machines to represent normal behavior, to approximating normal behavior
- GuardDuty has an AWS console that consists of a findings dashboard and functionality for customers to review, investigate, search, filter, manage, and respond to GuardDuty security findings Auto – Archive feature (Examples: SSH for bastion, portscan for vuln tool, anything you don’t want to action on) In the right hand pane GuardDuty provides actionable alerts that include detailed information about the threat and AWS resources involved.
- GuardDuty can be leveraged vie the CLI/SDK/API using a JSON format which really means all of the information can be used in a machine to machine use case or more generally integrating with various technologies Using…
- CloudWatch Events Aggregation logic Auto-Archive suppression Sample Findings
- AWS Security Hub workflow Get started in a few clicks and a few more for multi-account rollup No normalization or parsing needed with AWS Security Finding Format 28 partner integrations with simple setup (a few clicks to 15 min of CloudFormation deployment); 3 fully automated AWS integrations 25+ out-of-the-box AWS correlation and stacking rules called “insights” and ability for customers to create their own; plus default ones from partners coming soon. Automated compliance checks via CIS AWS Foundations Benchmark Automated response and remediation actions on specific findings via CloudWatch Events rules and targets You can set up AWS Security Hub in the AWS Management Console by clicking the “Enable Security Hub” button and adding your AWS accounts to the service. The process of ingesting data across the AWS security services begins. Security Hub (CLICK) aggregates findings from AWS security services and partner security tools and correlate them to identify the highest priority findings. As an additional step, (CLICK) Security Hub conducts continuous and automated compliance checks using industry standards and provide the results to you for remediation. Finally, you may review the findings (CLICK) in the console and select the ones for specific actions such as sending finding to ticketing, chat, email, or automated remediation via CloudWatch Events and Lambda.
- AWS Security Hub workflow Get started in a few clicks and a few more for multi-account rollup No normalization or parsing needed with AWS Security Finding Format 28 partner integrations with simple setup (a few clicks to 15 min of CloudFormation deployment); 3 fully automated AWS integrations 25+ out-of-the-box AWS correlation and stacking rules called “insights” and ability for customers to create their own; plus default ones from partners coming soon. Automated compliance checks via CIS AWS Foundations Benchmark Automated response and remediation actions on specific findings via CloudWatch Events rules and targets You can set up AWS Security Hub in the AWS Management Console by clicking the “Enable Security Hub” button and adding your AWS accounts to the service. The process of ingesting data across the AWS security services begins. Security Hub (CLICK) aggregates findings from AWS security services and partner security tools and correlate them to identify the highest priority findings. As an additional step, (CLICK) Security Hub conducts continuous and automated compliance checks using industry standards and provide the results to you for remediation. Finally, you may review the findings (CLICK) in the console and select the ones for specific actions such as sending finding to ticketing, chat, email, or automated remediation via CloudWatch Events and Lambda.
- 1.1 Avoid the use of the "root" account 1.2 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password 1.3 Ensure credentials unused for 90 days or greater are disabled 1.4 Ensure access keys are rotated every 90 days or less 1.5 Ensure IAM password policy requires at least one uppercase letter 1.6 Ensure IAM password policy requires at least one lowercase letter 1.7 Ensure IAM password policy requires at least one symbol 1.8 Ensure IAM password policy requires at least one number 1.9 Ensure IAM password policy requires minimum password length of 14 or greater 1.10 Ensure IAM password policy prevents password reuse 1.11 Ensure IAM password policy expires passwords within 90 days or less 1.12 Ensure no root account access key exists 1.13 Ensure MFA is enabled for the "root" account 1.14 Ensure hardware MFA is enabled for the "root" account 1.16 Ensure IAM policies are attached only to groups or roles 1.20 1.22 Ensure IAM policies that allow full "*:*" administrative privileges are not created 2.1 Ensure CloudTrail is enabled in all regions 2.2 Ensure CloudTrail log file validation is enabled 2.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible 2.4 Ensure CloudTrail trails are integrated with CloudWatch Logs 2.5 Ensure AWS Config is enabled in all regions 2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket 2.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs 2.8 Ensure rotation for customer created CMKs is enabled 2.9 Ensure VPC flow logging is enabled in all VPCs 3.1 Ensure a log metric filter and alarm exist for unauthorized API calls 3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA 3.3 Ensure a log metric filter and alarm exist for usage of "root" account 3.4 Ensure a log metric filter and alarm exist for IAM policy changes 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures 3.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs 3.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes 3.10 Ensure a log metric filter and alarm exist for security group changes 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) 3.12 Ensure a log metric filter and alarm exist for changes to network gateways 3.13 Ensure a log metric filter and alarm exist for route table changes 3.14 Ensure a log metric filter and alarm exist for VPC changes 4.1 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22 4.2 Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 4.3 Ensure the default security group of every VPC restricts all traffic
- 1.1 Avoid the use of the "root" account 1.2 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password 1.3 Ensure credentials unused for 90 days or greater are disabled 1.4 Ensure access keys are rotated every 90 days or less 1.5 Ensure IAM password policy requires at least one uppercase letter 1.6 Ensure IAM password policy requires at least one lowercase letter 1.7 Ensure IAM password policy requires at least one symbol 1.8 Ensure IAM password policy requires at least one number 1.9 Ensure IAM password policy requires minimum password length of 14 or greater 1.10 Ensure IAM password policy prevents password reuse 1.11 Ensure IAM password policy expires passwords within 90 days or less 1.12 Ensure no root account access key exists 1.13 Ensure MFA is enabled for the "root" account 1.14 Ensure hardware MFA is enabled for the "root" account 1.16 Ensure IAM policies are attached only to groups or roles 1.20 1.22 Ensure IAM policies that allow full "*:*" administrative privileges are not created 2.1 Ensure CloudTrail is enabled in all regions 2.2 Ensure CloudTrail log file validation is enabled 2.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible 2.4 Ensure CloudTrail trails are integrated with CloudWatch Logs 2.5 Ensure AWS Config is enabled in all regions 2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket 2.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs 2.8 Ensure rotation for customer created CMKs is enabled 2.9 Ensure VPC flow logging is enabled in all VPCs 3.1 Ensure a log metric filter and alarm exist for unauthorized API calls 3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA 3.3 Ensure a log metric filter and alarm exist for usage of "root" account 3.4 Ensure a log metric filter and alarm exist for IAM policy changes 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures 3.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs 3.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes 3.10 Ensure a log metric filter and alarm exist for security group changes 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) 3.12 Ensure a log metric filter and alarm exist for changes to network gateways 3.13 Ensure a log metric filter and alarm exist for route table changes 3.14 Ensure a log metric filter and alarm exist for VPC changes 4.1 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22 4.2 Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 4.3 Ensure the default security group of every VPC restricts all traffic
- Standards is one of the methods used by Security Hub to process findings. This method uses compliance frameworks that are based on regulatory requirements or AWS best practices. AWS has defined specific evaluation checks that align to the controls within a certain compliance standard. CIS, or Center for Internet Security, AWS Foundations Benchmark is the compliance standard currently being used by Security Hub. AWS Security Hub creates a score to inform you how your AWS environment is doing against the CIS Benchmark and displays it on the main dashboard. When you click through to the standard, you will see a summary of the controls that need your attention. Security Hub also shows informational best practices on how to mitigate each compliance issue.
- We do all the heavy lifting of provisions processing and storing logs We take those logs and extract important records and combine them into a federated view Then present them in an organized time series view that power investigations and reduce mean time to respond Out of the box we keep this information for a full year so you can historically go back in time
- Amazon Detective automatically processes terabytes of event data records about IP traffic, AWS management operations, and malicious or unauthorized activity. It organizes the data into a graph model that summarizes all the security-related relationships in your AWS environment. Amazon Detective then queries this model to create visualizations used in investigations. The graph model is continuously updated as new data becomes available from AWS resources, so you spend less time managing constantly changing data. Amazon Detective is integrated with AWS security services such as Amazon GuardDuty and AWS Security Hub as well as AWS partner security products to help quickly investigate security findings identified in these services. Using a single-click from these integrated services you can go to Amazon Detective and immediately see events related to the finding, drill down into relevant historical activities and investigate the issue. For example, from an Amazon GuardDuty finding, you can launch Amazon Detective by clicking on “Investigate” that provides instant insight into the relevant activity for the involved resource, giving you the details and context to quickly decide whether the detected finding reflects actual suspicious activity. Amazon Detective produces visualizations with the information you need to investigate and respond to security findings. It helps you answer questions like ‘is this normal for this role to have so many failed API calls?’ or ‘is this spike in traffic from this instance expected?’ without having to organize any data or develop, configure, or tune your own queries and algorithms. Amazon Detective maintains up to a year of historical event data that shows changes in the type and volume of activity over a selected time window, and links those changes to security findings.
- Benefits [“Why”] Faster and more effective investigations Amazon Detective presents a unified view of user and resource interactions over time, with all the context and details in one place to help you quickly analyze and get to the root cause of a security finding. For example, an Amazon GuardDuty finding, like an unusual Console Login API call, can be quickly investigated in Amazon Detective with details about the API call trends over time, and user login attempts on a geolocation map. These details enable you to quickly identify if you think it is legitimate or an indication of a compromised AWS resource. Save time and effort with continuous data updates Amazon Detective automatically processes terabytes of event data records about IP traffic, AWS management operations, and malicious or unauthorized activity. It organizes the data into a graph model that summarizes all the security-related relationships in your AWS environment. Amazon Detective then queries this model to create visualizations used in investigations. The graph model is continuously updated as new data becomes available from AWS resources, so you spend less time managing constantly changing data. Easy to use visualizations Amazon Detective produces visualizations with the information you need to investigate and respond to security findings. It helps you answer questions like ‘is this normal for this role to have so many failed API calls?’ or ‘is this spike in traffic from this instance expected?’ without having to organize any data or develop, configure, or tune your own queries and algorithms. Amazon Detective maintains up to a year of historical event data that shows changes in the type and volume of activity over a selected time window, and links those changes to security findings.
- You may be organized with tier one analysts Or you may have a small team that is responsible for all of it