Building a better lake: Federated search for Amazon Security Lake
summary
Splunk announces a two-part integration with Amazon Security Lake that lets Splunk run searches and detections against Lake data without long‑term ingestion: Federated Search queries S3-style Lake stores ad hoc, while Federated Analytics streams selected OCSF‑mapped records into a temporary rolling index for ES rules and dashboards. Supported sources include CloudTrail, VPC flow, WAF and CloudWatch; Splunk ships out‑of‑box detections. The feature is announced but not yet GA.
AI-written summary · about
chapters (7)
- 0:00Introduction and partnership
- 2:14Amazon security lake overview
- 4:20Splunk vs. security lake
- 6:57Challenges in data integration
- 10:40Federated analytics use cases
- 15:06Federated search and analytics
- 19:34Closing and next steps
related talks
15mGet the most out of Splunk Enterprise, OCSF & Amazon Security Lake
54mBuild your security data lake w/ Amazon Security Lake, featuring
38mGet the most out of Splunk Security, OCSF, and Amazon Security Lake
39mAmazon Security Lake: Analyze Multiple Security Events
17mUnifying Your Security Data with Amazon Security Lake and OCSF
13mCloud-powered security with Amazon Security Lake & PwC’s fusion center
17mArchitecting a security data lake at enterprise scale
24mAnalytics-based investigation & automated response