Securing data and democratizing the alert landscape
summary
Claim: AWS native detectors plus EventBridge-driven serverless orchestration let teams triage and remediate at cloud scale. The pipeline uses GuardDuty, Macie, Inspector, Security Hub, Security Lake to generate ASFF findings, a triage/routing Lambda that normalizes schemas and runs “skills” (checks, enrichment, SBOM and automated sensitive data discovery sampling <1%), and dispatch targets via EventBridge→Lambda→Step Functions to ticketing, tagging or network blocks. Comcast pilots an abstraction layer, uses alerts as code and budget-day prioritization and reports consistent, repeatable reductions in duplicated work.
AI-written summary · about
chapters (10)
- 0:00Introduction and challenges
- 3:06Overview of AWS security tools
- 6:04Deep dive into GuardDuty
- 12:29Vulnerability management
- 15:40Sensitive data discovery
- 18:51Security Hub and data logs
- 22:17Amazon Security Lake
- 26:30Responding to alerts at scale
- 39:57Democratizing the alert landscape
- 1:01:24Conclusion
related talks
51mInnovations in AWS detection and response services
34mLayering AWS security services to automate incident response
54mHow to layer threat detection & monitoring security services
32mAdvanced threat detection and response on AWS
28mPatterns for scalable security detections on AWS
29mAutomating Threat Detection and Remediation
27mProactively identifying threats & protecting sensitive data in S3
18mHow AWS Partners use observability to strengthen customer security