CloudTrail Logging Internals: Investigating AWS Security Incidents
summary
Explains a methodology for investigating AWS control plane security incidents using CloudTrail logging; includes a technical deep-dive into CloudTrail internals and a demonstration investigating a GuardDuty alert. Covers how specific CloudTrail details can be used to conduct faster, more accurate threat investigations.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:12Disclaimer #2
- 1:14The AWS Control Plane
- 2:55Data Sources for Control Plane Investigation
- 3:49GuardDuty Alert as an Example
- 4:15Basic triage questions
- 7:06CloudTrail Best Practices
- 8:36Athena & CloudTrail
- 9:22Answering "who did it?"
- 11:46AWS Identity Chains - more complex
- 12:37Next question - "What did they do?"
- 12:56ARNs aren't unique; access keys are
- 13:31Following the access keys
- 16:47Web console internals - recap
- 18:00Some tips in constructing meaningful sessions
- 18:18Some CloudTrail corners... #3
- 24:48Fun quirk #1 - CloudTrail source IP spoofing
- 25:34Technique Overview
- 26:46Fun quirk #2 - API access key recycling
- 29:01What AWS can improve
- 29:42AWS Detective
- 30:15Apply What You Have Learned Today
related talks
20mFantastic AWS Attacks and Where to Find Them
55mStreamline security analysis with Amazon Detective
29mAutomating Threat Detection and Remediation
18mCentralize user activity from external sources in AWS CloudTrail Lake
25mLogging, Monitoring, and Alerting in AWS (The TL;DR)
29mCloud compliance and assurance
18mHow AWS Partners use observability to strengthen customer security
27mIntroduction to AWS Security