Patterns for scalable security detections on AWS
summary
Shows how Datadog ingests AWS logs (CloudTrail plus app logs), remaps fields into a standard schema (example: network.client.ip), enriches with GeoIP and threat intel (GreyNoise, AWS IP ranges), and builds detections that actually work: alert on logins without MFA, detect credential stuffing by 100+ failures then a success from one IP, flag security groups with 0.0.0.0/0, and run per-account “no-log” alerts for missing CloudTrail. Demo proves dashboards and pivots tie those signals to hosts and metrics.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:21And then there's application logs
- 5:33The goal
- 6:55Custom application log - Missing information
- 9:39Log attributes need standardization
- 12:28Threat intel
- 13:31AWS IP ranges
- 15:12Security group open to the world
- 16:07Credential stuffing (custom AuthN logs)
- 17:37Benefit recap
- 18:57Monitor for changes to logs
- 20:18Monitor for missing logs: "Deadman"
related talks
28mPatterns for scalable security detections on AWS
55mStreamline security analysis with Amazon Detective
29mAutomating Threat Detection and Remediation
20mFantastic AWS Attacks and Where to Find Them
25mLogging, Monitoring, and Alerting in AWS (The TL;DR)
18mHow AWS Partners use observability to strengthen customer security
37mOptimizing Cloud Detection & Response With Security Chaos Engineering
34mLayering AWS security services to automate incident response