Advanced threat detection and response on AWS
summary
AWS shows a concrete pipeline that enables automated threat detection and response across accounts using Amazon GuardDuty (auto-ingests VPC flow logs, DNS, CloudTrail and S3 data plane events and uses partner threat intel from Proofpoint and CrowdStrike), AWS Security Hub (normalizes findings to Amazon Security Finding Format, runs 150+ automated controls, 50+ Foundational checks, integrates with 60+ partners) and Amazon Detective (behavioral graph for one-year investigation). Orchestration uses Organizations, EventBridge/CloudWatch, Lambda/Step Functions and CloudFormation playbooks for remediation.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:26AWS foundational and layered security services
- 5:17Understanding an AWS account
- 6:23Security organizational unit: Multi-account strategy
- 7:34Threat detection, monitoring, and response
- 12:02Amazon Guard Duty built-in data sources
- 15:10Acting on findings
- 17:28How AWS Security Hub works
- 20:16Partner integrations (60+ external partners and open-source tools)
- 21:19Integrate your own customizations
- 21:37Automated security and compliance checks
- 22:44AWS Security Hub insights
- 23:30Use Security Hub custom actions to trigger automation
- 24:07Customizable response and remediation actions
- 24:27AWS Security Hub Automated Response and Remediation solution architecture
- 24:51Security Hub as a central dashboard
- 25:26Scalable and centralized management
- 26:35Amazon Detective benefits
- 27:26Amazon Detective usage flow
- 28:03Multi-account telemetry collection
- 28:38Security behavior graph
- 29:51Key takeaways
- 30:36Learn security with AWS Training and Certification
related talks
25mAdvanced Threat Detection and Automated Response on AWS
34mLayering AWS security services to automate incident response
29mAutomating Threat Detection and Remediation
56mContinuous innovation in AWS detection and response services
51mInnovations in AWS detection and response services
27mIntroduction to AWS Security
54mHow to layer threat detection & monitoring security services
27mProactively identifying threats & protecting sensitive data in S3