OCSF for security at the edge with AWS AppFabric and Barracuda XDR
summary
Barracuda XDR ingests SaaS logs through AWS AppFabric which pushes data into Amazon Security Lake and Firehose converts them into OCSF JSON that XDR reads from S3/SQS, enabling correlation across email, endpoint, network and 40+ integrations. Claims include 12 zero day detections per second, ~1,000,000 zero day events per day, 500,000+ phishing blocks daily and ~200,000 malicious IPs seen daily. Demo shows impossible travel detection for Slack with suspend user action, and measured mean time to remediate drops from weeks or months to ~2 hours with plans to cut to minutes using LLMs.
AI-written summary · about
chapters (5)
related talks
12mSecurity data gravity: Visibility & threat detection for data lakes
13mStreamline security operations and improve threat detection with OCSF
47mDeveloping an autonomous framework with Security Lake & Torc Robotics
17mUnifying Your Security Data with Amazon Security Lake and OCSF
01h 02mSecuring data and democratizing the alert landscape
15mGet the most out of Splunk Enterprise, OCSF & Amazon Security Lake
24mAnalytics-based investigation & automated response
32mFrom Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF