Analytics-based investigation & automated response
summary
Shows end-to-end integration of AWS security sources into Splunk: GuardDuty, CloudTrail, VPC Flow Logs and Security Hub flow via EventBridge or Kinesis Firehose into Splunk Enterprise Security and indexers using HTTP Event Collector for scale. Correlation searches map findings to the CIM, surface notables and hand off to Phantom playbooks via SQS. Playbooks automatically investigate IOC reputation, create tickets and can isolate an exposed EC2 by modifying its security group, demonstrating automated detection, investigation and response working at scale.
AI-written summary · about
chapters (18)
- 0:00Start
- 0:22Agenda
- 1:11Shared responsibility model
- 3:10AWS security, identity, and compliance solutions
- 3:40Scale with superior visibility and control
- 4:47Automate security and reduce risk with unified services
- 6:18Why is security automation important?
- 6:58Where does security automation fit?
- 7:47AWS foundational and layered security services
- 9:33Use cases for today
- 12:05Splunk Security Operations Suite
- 12:48Data sources from AWS Security Services
- 13:08AWS data flow for use cases
- 16:26Account protection resources
- 17:25Maintaining compliance
- 18:04Amazon Kinesis Data Firehose benefits
- 18:59Automated cloud security incident response
- 20:52Cloud SOAR use case
related talks
24mAnalytics-based investigation & automated response
55mStreamline security analysis with Amazon Detective
34mLayering AWS security services to automate incident response
51mInnovations in AWS detection and response services
56mContinuous innovation in AWS detection and response services
54mHow to layer threat detection & monitoring security services
49mBuilding digital resilience with unified security and observability
01h 02mSecuring data and democratizing the alert landscape