Streamline security analysis with Amazon Detective
summary
Amazon Detective automatically ingests GuardDuty, Inspector, CloudTrail, VPC flow logs and Security Hub findings and builds a year-long behavior graph with ML-weighted edges to surface correlated events. In a reproduced Log4j scenario an attacker scans, exploits an external EC2, pivots to an internal EC2, assumes a high-privilege IAM role and downloads an S3 object; Detective’s finding groups cluster CVE, port-scan, role-assume and S3 access into one event, visualizes linked entities and timelines, and recommends patching, IAM tightening and S3 controls.
AI-written summary · about
chapters (8)
- 0:00Introduction to detective
- 1:31Empowering security teams
- 4:00Challenges in cloud security
- 9:11Detective automation features
- 18:14Finding groups demo
- 24:57Visualizing security threats
- 36:07Customer experience at Asurion
- 54:48Session wrap-up
related talks
54mHow to layer threat detection & monitoring security services
29mAutomating Threat Detection and Remediation
34mLayering AWS security services to automate incident response
51mInnovations in AWS detection and response services
28mPatterns for scalable security detections on AWS
24mAnalytics-based investigation & automated response
32mAdvanced threat detection and response on AWS
17mElevating security investigations with generative AI