Multi-Cloud Security Monitoring and CIS Benchmarks Evaluation at Scale
summary
A plugin-based monitoring system uses cloud provider APIs to pull resource JSON, normalize it into a cloud-independent com/ext/raw model, index to Splunk/Elastic/Mongo/MongoDB, run lightweight event evaluators (30–40 lines) and emit alerts and audit records for CIS checks. An open-source reference called CloudMarker (Python) implements multiprocessing plugins, per-cloud plugins, store/event/alert hooks, and reports whether OS disks or TLS versions fail CIS tests at scale (examples show handling 100k+ instances). supports Splunk, ElasticSearch, MongoDB
AI-written summary · about
chapters (13)
- 0:00Start
- 2:18Data records compromised in 2019
- 3:43Architecture
- 9:23Key Features
- 10:36How the data looks like?
- 10:56The RAW Bucket
- 11:36The EXT' Bucket
- 13:03The 'COM' Bucket
- 15:12CIS Benchmarks for Cloud Audits
- 16:44Resources Audited
- 19:19How it works?
- 21:48Event Example
- 28:35Apply What You Have Learned Today
related talks
43mWalking on Broken Clouds
15mSecuring the Cloud and Training Your Dragons
11mReducing exposure in the cloud
53mMonitoring Multiple Cloud Providers Made Easy
43mMulti-Cloud Magic: Leveraging Multi-Cloud Clusters in Real-World Scenarios
16mInfrastructure security, visibility and cost-optimization
44mCloud Security Podcast - LIVE!
20mMulticloud and the Chamber of Secrets