Get the most out of Splunk Enterprise, OCSF & Amazon Security Lake
summary
Splunk shows a concrete integration path with Amazon Security Lake: Security Lake uses OCSF 1.0 RC2 and requires Parquet files, and Splunk ingests those Parquet OCSF JSON files by monitoring the Security Lake S3/SQS pipeline. The current release uses the AWS add-on for Splunk v7 to support data access mode (select whole data sources only) and will add federated query mode for ad hoc S3 searches; CIM mapping for Enterprise Security is provided and ongoing work targets data tiering and selective routing.
AI-written summary · about
chapters (5)
related talks
38mGet the most out of Splunk Security, OCSF, and Amazon Security Lake
20mBuilding a better lake: Federated search for Amazon Security Lake
17mUnifying Your Security Data with Amazon Security Lake and OCSF
20mData lake deep dive: Using accelerated indexing for threat detection
22mUse generative AI and Amazon Security Lake to enhance threat analysis
13mCloud-powered security with Amazon Security Lake & PwC’s fusion center
47mDeveloping an autonomous framework with Security Lake & Torc Robotics
39mAmazon Security Lake: Analyze Multiple Security Events