A guide to strengthening your threat detection and response
summary
Gartner projects 85% cloud-first adoption and the talk shows concrete steps to detect and respond across many AWS accounts using Rapid7’s InsightCloudSec plus AWS metadata and tags. Real-time event streaming replaces hourly snapshots, CI/CD template scanning prevents misconfigurations, and detections target things like admin IAM roles attached to resources, publicly exposed buckets, or logins from unexpected countries. Automated playbooks can spin down a resource, enrich alerts with owner/app tags, post to Slack, and reduce alert noise while preserving production-context tuning.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:21Cloud first strategy
- 1:09Unseen areas
- 3:40Context
- 5:15Visibility
- 7:14Misconfigurations
- 8:34Detecting suspicious behavior
- 11:04Metadata
- 12:17Summary
related talks
32mAdvanced threat detection and response on AWS
45mProtecting you from you: Misconfiguration-caused breaches
20mFantastic AWS Attacks and Where to Find Them
25mAdvanced Threat Detection and Automated Response on AWS
56mContinuous innovation in AWS detection and response services
37mOptimizing Cloud Detection & Response With Security Chaos Engineering
51mInnovations in AWS detection and response services
18mHow AWS Partners use observability to strengthen customer security