Analytics-based investigation & automated response
summary
Shows concrete integrations: GuardDuty, VPC Flow Logs, CloudTrail and Security Hub feed via EventBridge or Kinesis Firehose into Splunk Enterprise Security, mapped to the CIM so findings generate notables and trigger analytics. Security orchestration uses Splunk Phantom playbooks to enrich IOCs, create tickets and, when scores exceed thresholds, execute remediation like Phantom playbooks modify security group to isolate an EC2 instance. Architecture scales with Firehose and HTTP Event Collector for high‑volume indexing.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:25Aws Security Principles and Best Practices
- 1:00Security Principles
- 6:20Why Secure Automation Is Important
- 6:59Where Does Security Automation Fit
- 12:09Security Solutions
- 12:50Critical Data Sources
- 13:07What Is the Typical Data Flow and Use Case
- 14:38Use Cases
- 19:05Typical Incident Response
related talks
24mAnalytics-based investigation & automated response
49mBuilding digital resilience with unified security and observability
01h 02mSecuring data and democratizing the alert landscape
55mStreamline security analysis with Amazon Detective
51mInnovations in AWS detection and response services
42mscales security capabilities with Splunk and
38mGet the most out of Splunk Security, OCSF, and Amazon Security Lake
54mHow to layer threat detection & monitoring security services