Continuous innovation in AWS detection and response services
summary
Amazon consolidates detection and response: GuardDuty adds EKS audit and EBPF-based runtime agent telemetry, two dozen container/runtime detections, Lambda network protection and automated volume malware scans (snapshots + Bitdefender) that surface files; Detective retains 12 months of correlated API, flow and finding data and maps groups to MITRE to speed root-cause tracing; Inspector runs near-continuous checks across EC2/ECR/Lambda, adds CodeGuru-powered code scanning and exports SBOMs (CycloneDX/SPDX); Security Lake (GA) centralizes logs into S3 and normalizes to the Open Cybersecurity Schema Framework for in-place queries and partner analytics.
AI-written summary · about
chapters (8)
- 0:00Introduction and overview
- 2:07AWS security services portfolio
- 9:17Amazon GuardDuty deep dive
- 27:49Amazon Detective features
- 35:04Amazon Inspector vulnerabilities
- 42:37Security Hub orchestration
- 49:45Amazon Security Lake overview
- 55:22Summary and closing
related talks
51mInnovations in AWS detection and response services
32mAdvanced threat detection and response on AWS
54mHow to layer threat detection & monitoring security services
34mLayering AWS security services to automate incident response
29mAutomating Threat Detection and Remediation
27mProactively identifying threats & protecting sensitive data in S3
06mDemo - Amazon S3 security posture management and threat detection
37mOptimizing Cloud Detection & Response With Security Chaos Engineering