How to layer threat detection & monitoring security services
summary
AWS lays out a layered stack that actually gathers telemetry and produces actionable findings without extra logging, tying GuardDuty (now with S3 and EKS audit log protection) to Detective’s behavioral graph for pivotable root cause analysis, Inspector relaunched to use the SSM agent for EC2 and ECR image scans and to perform continuous differential scans that update finding state, and Security Hub to aggregate multi-account, cross‑region results in ASFF, forward JSON events to SIEM/EventBridge and invoke Lambda/Step Functions for automated remediation.
AI-written summary · about
chapters (9)
- 0:00Introduction and agenda
- 1:26Account-level security
- 3:35Core security services
- 6:24Centralized monitoring
- 11:07GuardDuty deep dive
- 16:37Inspector capabilities
- 23:18Demo: GuardDuty and Inspector
- 37:14Security Hub and orchestration
- 49:10Conclusion and resources
related talks
34mLayering AWS security services to automate incident response
51mInnovations in AWS detection and response services
56mContinuous innovation in AWS detection and response services
55mStreamline security analysis with Amazon Detective
32mAdvanced threat detection and response on AWS
29mAutomating Threat Detection and Remediation
27mProactively identifying threats & protecting sensitive data in S3
01h 02mSecuring data and democratizing the alert landscape