Data lake deep dive: Using accelerated indexing for threat detection
summary
Splunk integrates with Amazon Security Lake to run detections without ingesting high-volume logs by using federated search for Security Lake and a data lake index that acts as a rolling window temporary index. Setup uses SQS S3 for data access, Lake Formation and Glue Data Catalog tables as providers, and requires same-region (Oregon) connections. It pulls VPC flow logs, CloudTrail and Security Hub findings into short retentions (examples: 24 hours or seven days), supports scheduled enterprise detections and ad hoc hunts, and does not persist data in Splunk unless explicitly elevated.
AI-written summary · about
chapters (4)
- 0:00Introduction and challenges
- 3:15Federated analytics overview
- 11:13Setting up the integration
- 17:21Searching and validation
related talks
54mBuild your security data lake w/ Amazon Security Lake, featuring
27mRealise the value of data with Splunk
39mAmazon Security Lake: Analyze Multiple Security Events
42mThreat Detection across all environments with SnowflakeData Security Lake
28mDeep Dive Into AWS Lake Formation
17mUnifying Your Security Data with Amazon Security Lake and OCSF
15mGet the most out of Splunk Enterprise, OCSF & Amazon Security Lake
38mGet the most out of Splunk Security, OCSF, and Amazon Security Lake