Get the most out of Splunk Security, OCSF, and Amazon Security Lake
summary
Splunk explains concrete integrations: an AWS Security Lake connector uses an SQS queue to pull Parquet OCSF data, translate it to JSON on index, and can map OCSF to CIM via an app; Splunk 7.0+ adds that capability and promises federated search later. OCSF now has ~150 vendor contributors, enforces field validation (IP fields must be IPs), and customers report VPC flow logs dominate volume and can blow license if indexed naively. A live demo shows searchable JSON records from Security Lake.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 2:58Understanding OCSF
- 7:00OCSF adoption and benefits
- 11:29OCSF, SIM, and validation
- 16:03Integrating OCSF with Splunk
- 18:53Amazon Security Lake
- 24:05Demo and configuration
- 29:36Use cases and conclusion
related talks
15mGet the most out of Splunk Enterprise, OCSF & Amazon Security Lake
17mUnifying Your Security Data with Amazon Security Lake and OCSF
20mBuilding a better lake: Federated search for Amazon Security Lake
54mBuild your security data lake w/ Amazon Security Lake, featuring
22mUse generative AI and Amazon Security Lake to enhance threat analysis
20mData lake deep dive: Using accelerated indexing for threat detection
24mAnalytics-based investigation & automated response
47mDeveloping an autonomous framework with Security Lake & Torc Robotics