Patterns for scalable security detections on AWS
summary
Argues that tiny, deliberate changes to log fields plus a lightweight normalization layer let you detect high‑value threats across AWS and app logs. Shows concrete work: a Datadog remapper pipeline that maps CloudTrail userIdentity.userName and sourceIPAddress into a standard network.client.ip mapping; geoIP and GreyNoise enrichment; reusable alerts for credential stuffing: 100+ failures then success, missing‑log (per accountID Deadman) and MFA‑absent, and security‑group 0.0.0.0/0 detection. Demo ties alerts to dashboards, surfaces a crypto‑miner and a VPC deletion, proving the approach scales.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:09Log data challenges
- 3:58Log taxonomy importance
- 6:55Log structure examples
- 10:47Log enrichment techniques
- 14:37Detection strategies
- 18:41Log changes and gaps
- 21:45Demo of investigation
- 27:36Closing and Q&A
related talks
28mPatterns for scalable security detections on AWS
55mStreamline security analysis with Amazon Detective
50mTo Normalized Logs, and Beyond - Building a Threat Detection...
01h 02mSecuring data and democratizing the alert landscape
20mFantastic AWS Attacks and Where to Find Them
18mHow AWS Partners use observability to strengthen customer security
25mLogging, Monitoring, and Alerting in AWS (The TL;DR)
29mAutomating Threat Detection and Remediation