Event-driven Security with AWS Security Services
summary
Centralized AWS events (CloudTrail, CloudWatch, EventBridge, GuardDuty) get filtered and routed via SNS and Lambda to targeted channels: root logins trigger SMS via Twilio to the cloud director, CI/CD high-CPU alarms post to Slack via webhook for the dev lead, and GuardDuty findings call a Particle cloud function that lights an on‑desk device. The prototype uses a Particle Boron (~$53) plus an Adafruit Circuit Playground (~$25) under $100 total, runs reliably over LTE, and proves event-driven, persona‑focused alerts reduce noise and speed response.
AI-written summary · about
chapters (12)
- 0:00Introduction and setup
- 1:07Speaker introduction
- 2:09Event-driven security concept
- 4:55Current state of cloud security
- 10:32User personas and needs
- 13:00Root user monitoring solution
- 16:29CI/CD server incident response
- 18:39Security incident response with GuardDuty
- 20:52Enhancing notifications with Lambda
- 22:59Slack integration for dev teams
- 23:21IoT alert device demo
- 31:34Summary and next steps
related talks
01h 02mSecuring data and democratizing the alert landscape
29mAutomating Threat Detection and Remediation
34mLayering AWS security services to automate incident response
35mThe Good, the Bad and the Ugly — one year of integrating AWS security services
24mOne EdTech’s journey to transforming its security practices
32mAdvanced threat detection and response on AWS
51mInnovations in AWS detection and response services
22mEmpowering the Employee: Incident Response with a Security Bot