Layering AWS security services to automate incident response
summary
Layered AWS services ingest telemetry automatically at the account level—GuardDuty one‑click enables VPC/DNS/CloudTrail data, generates findings stored 30 days; Detective retains behavioral data up to one year for root‑cause graphs; Security Hub normalizes findings to ASFF and aggregates across accounts via AWS Organizations. Example automated flow: GuardDuty finding for a malicious IP routes to Security Hub aggregation, EventBridge triggers a Step Function that invokes Lambda to update AWS Network Firewall rules and block traffic. CloudFormation templates and System Manager playbooks deploy these remediations at scale.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:00AWS foundational and layered security services
- 4:34Threat detection, monitoring, and response
- 7:06Scalable and centralized management
- 9:42Amazon Guard Duty: How it works
- 15:23Amazon Detective usage flow
- 16:14Multi-account telemetry collection
- 16:49Security behavior graph
- 19:58How AWS Security Hub works
- 21:48Automated security and compliance checks
- 22:52Security Hub as a central dashboard
- 25:05Automated detection and response
- 25:57Use Security Hub custom actions to trigger automation
- 27:07AWS Security Hub Automated Response and Remediation solution architecture
- 27:49Customizable response and remediation actions
- 30:49Best practice - multi-account management
- 31:50Layered threat detection and response services
- 33:01Learn security with AWS Training and Certification
related talks
54mHow to layer threat detection & monitoring security services
32mAdvanced threat detection and response on AWS
29mAutomating Threat Detection and Remediation
51mInnovations in AWS detection and response services
01h 02mSecuring data and democratizing the alert landscape
25mAdvanced Threat Detection and Automated Response on AWS
56mContinuous innovation in AWS detection and response services
55mStreamline security analysis with Amazon Detective