Automating Threat Detection and Remediation
summary
Shows how to wire CloudTrail, VPC Flow Logs and DNS into GuardDuty (uses CrowdStrike and Proofpoint intel, plus ML anomaly detection that needs ~7–14 days of training) and surface findings in Security Hub (31 AWS foundational checks, 43 CIS checks, org-wide GuardDuty for up to 5,000 accounts). Demo builds a Lambda that runs on CloudWatch Events to modify an EC2 instance’s security groups to isolate it — live demo succeeds — and Detective links logs into a graph for faster root‑cause.
AI-written summary · about
chapters (6)
- 0:00Security data sources
- 2:12Audit and logging services
- 7:04Amazon GuardDuty automation
- 13:33Security Hub overview
- 19:27Custom remediation demo
- 26:58Root cause with Detective
related talks
32mAdvanced threat detection and response on AWS
34mLayering AWS security services to automate incident response
54mHow to layer threat detection & monitoring security services
55mStreamline security analysis with Amazon Detective
56mContinuous innovation in AWS detection and response services
37mOptimizing Cloud Detection & Response With Security Chaos Engineering
51mInnovations in AWS detection and response services
06mDemo - Amazon S3 security posture management and threat detection