Unifying Your Security Data with Amazon Security Lake and OCSF
summary
Amazon Security Lake centralizes security telemetry, auto-normalizes it to OCSF and writes Parquet to S3 while registering Glue tables, so analysis tools use Athena or SageMaker instead of custom normalization. It claims to reduce five steps to three by handling ingestion, normalization and storage; preview supports 28 sources across 7 regions (cloudtrail, VPC flow logs, Route 53, Security Hub and custom sources). Data stays in the customer account to avoid vendor lock‑in and vendors like Trend Micro provide ingest guides.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:20Security data normalization challenges
- 1:44Security log format inconsistencies
- 3:08Current security data management
- 4:14Open Security Schema Framework
- 6:01Standardization efforts and adoption
- 7:26Amazon Security Lake
- 8:48Security Lake sources and subscribers
- 11:00Live demo setup
- 12:47Technical details
- 14:09Benefits of unified storage
- 15:34Summary
related talks
54mBuild your security data lake w/ Amazon Security Lake, featuring
22mUse generative AI and Amazon Security Lake to enhance threat analysis
39mAmazon Security Lake: Analyze Multiple Security Events
15mGet the most out of Splunk Enterprise, OCSF & Amazon Security Lake
38mGet the most out of Splunk Security, OCSF, and Amazon Security Lake
47mDeveloping an autonomous framework with Security Lake & Torc Robotics
13mCloud-powered security with Amazon Security Lake & PwC’s fusion center
13mClosing the security visibility gap