2019/05/29 で実施した Sumo Logic on AWS Webinar 登壇資料です。 https://aws.amazon.com/jp/featured-partners-jp/sumologic/ ▼Agenda • What is AWS? • Monitoring on AWS • AWS モニタリングソリューション • AWS モニタリングソリューションの活用 • まとめ

1. Amazon Web Services Japan K.K.
Partner Solutions Architect
Takanori Ohba
AWS
Sumo Logic on AWS
2019/05/29

2. Who am I ?
l po S
Ø .1 A 5 / BA @ ( A5 A
( 1 052 /5 C 5@ 1 1
5
)1 B
Ø (0/ Sg h (0/
Ø 052 aWM ibe i
Ø km eP ci J Sg d
n K (0/ aW
Ø (0/ / @A5 @ 1 1 5
Ø (0/ /5 C5 1A /5 C 5
Ø (0/ /5 C 5 1A1

3. cn a w : mA :
s z ( ) W 1 2 . 50/ 0. :
n A n ( ) W
p 9 ( ) W :
: w
, : , . , :, . , , : : / .,
, :/ :/, : , . ,, , : , : /:: . ,, , :
. : , :/ , : , , : :, ., / .,
, , , , : : :/ : / , , :/ / ., , , :
, , , :/, , : :, ,
: ac ht o S
:

4. Agenda
• What is AWS?
• Monitoring on AWS
• AWS
• AWS
•

5. What is AWS?

6. What is AWS?
• IT
•
• 165
ComputeMessaging
Mobile
App Services
Database
Networking
Development and
Management Tools
Payments
VPC
On-Demand Workforce
Analytics Content Delivery
Storage

8. 24 48 61 82
159
280
516
722
1,017
1,430
1,957
0
200
400
600
800
1,000
1,200
1,400
1,600
1,800
2,000
2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018
AWS

9. 165 AWS

10. AWS

11. Monitoring on AWS

12. Monitoring on AWS
• Metrics-Based
• / ( )
• / ( )
• Event-Based
•
• Rule-Based
•
Metrics-Based
Event-Based Rule-Based

13. AWS X-Ray
•
• /
Amazon CloudWatch
• /
• ( )
AWS Trusted Advisor
• AWS
• AWS
Amazon GuardDuty
•
•
Amazon Macie ( )
•
•
AWS CloudTrail
• API
• /
AWS Config
•
•
AWS Security Hub
•
•
Monitoring with AWS Service

14. AWS

15. Amazon CloudWatch
CloudWatch
• CloudWatch
• CloudWatch Logs
• CloudWatch Logs Insights
• CloudWatch Events

16. Amazon CloudWatch
• CloudWatch
Ø AWS
ü / /
• CloudWatch Logs
• CloudWatch Logs Insights
• CloudWatch Events
CloudWatch

17. CloudWatch Dashboards

18. Amazon CloudWatch
AutoScaling

19. Amazon CloudWatch
• CloudWatch
Ø AWS
ü / /
• CloudWatch Logs
Ø
ü EC2 OS, APP
ü AWS
• CloudWatch Logs Insights
• CloudWatch Events
CloudWatch

20. CloudWatch Logs

21. CloudWatch Logs
CloudWatch Alarm
Amazon Elasticsearh
Service
(Kibana)
Amazon Kinesis
Data Firehose

22. Amazon CloudWatch
• CloudWatch
Ø AWS
ü / /
• CloudWatch Logs
Ø
ü EC2 OS, APP
ü AWS
• CloudWatch Logs Insights
Ø
• CloudWatch Events
CloudWatch

23. CloudWatch Logs Insights

24. Amazon CloudWatch
• CloudWatch
Ø AWS
ü / /
• CloudWatch Logs
Ø
ü EC2 OS, APP
ü AWS
• CloudWatch Logs Insights
Ø
• CloudWatch Events
Ø AWS
Ø AWS
CloudWatch

25. CloudWatch Events
Auto Scaling
Amazon EC2 AWS
Lambda
Amazon
SQS
Amazon
SNS
AWS Step
Functions
AWS
Systems
Manager
Event Source Target
AWS

26. AWS X-Ray

27. AWS X-Ray
l k L
W c l
s
l k s
S S B
l k s
A z L
W c l l m B
n bd i
E ma
2 2
, 2
Cz
A
mE
e l k
W c L Ei o
W c t

28. X-Ray
End-to-end

29. AWS X-Ray

30. X-Ray
/ 2 / / /
/
-
-
2/ /
/
KG K
C IK E D
/ - A K
B L

32. •
• 5xx errors
• 4xx errors
• 429 Too Many Requests
( )

33. •
• 5xx errors
• 4xx errors
• 429 Too Many Requests
( )
(ms)
(trace/min)

34. •
•
•

35. AWS X-Ray
X-Ray
X-Ray API

36. AWS X-Ray

37. AWS X-Ray

38. AWS X-Ray X-Ray SDK X-Ray API

46. AWS CloudTrail
• AWS
• API
• S3
• gz
S3
• CloudTrail
•CloudTrail

47. AWS
https://aws.amazon.com/jp/answers/account-management/real-time-insights-account-activity/
Amazon Cognito
Real Time
Dashboard
Amazon DynamoDB
Table
AWS Lambda
Function
Amazon Kinesis
Data Streams
(Events)
Amazon Kinesis
Data Analytics
Amazon S3
Bucket (Events)
Amazon Kinesis
Data Firehose
(Events)
Amazon CloudWatch
Event
AWS
CloudTrail

48. AWS Config / Config Rules
• AWS
•
S3
• SNS
•
• AWS
• (Lambda Function)AWS Config

49. AWS Config Rules

50. •
• (PII) (PHI)
(IP) API
•
• Amazon S3
3 C A

51. Amazon Macie
•
•
•
•
•
•
•

52. S3
•
•
•
•
•
•
•

53. Amazon GuardDuty
• I
I I P
•
W AI
• VPC Flow Logs
• AWS CloudTrail Event Logs
• DNS Logs
•
S I
Amazon GuardDuty

54. GuardDuty
Amazon
GuardDuty
VPC flow logs
DNS Logs
CloudTrail
HIGH
MEDIUM
LOW
Findings

55. Threat Detection Types
Instance Recon:
• Port Probe/Accepted Comm
• Port Scan (intra-VPC)
• Brute Force Attack (IP)
• Drop Point (IP)
• Tor Communications
Account Recon:
• Tor API Call (failed)
• C&C Activity
• Malicious Domain Request
• EC2 on Threat List
• Drop Point IP
• Malicious Comms (ASIS)
• Bitcoin Mining
• Outbound DDoS
• Spambot Activity
• Outbound SSH Brute Force
• Unusual Network Port
• Unusual Traffic
Volume/Direction
• Unusual DNS Requests
• Domain Generated Algorithms
• Malicious API Call (bad IP)
• Tor API Call (accepted)
• CloudTrail Disabled
• Password Policy Change
• Instance Launch Unusual
• Region Activity Unusual
• Suspicious Console Login
• Unusual ISP Caller
• Mutating API Calls (create,
update, delete)
• High Volume of Describe calls
• Unusual IAM User Added
Signature Based Stateless Findings Behavioral Stateful Findings and Anomaly Detections

56. What can you monitor today ?

57. Finding
• CloudWatch Events
• GuardDuty

58. Slack Integration – Lambda Function

59. CloudWatch Events
AWS
Cloud

60. AWS Security Hub
• AWS
• AWS
•
Amazon
Inspector
Amazon
GuardDuty
Amazon
Macie
AWS Security Hub
Security
findings
providers
Findings
Insights
&
Standards
Other
AWS
Config
Partner
Solutions

64. AWS

65. AWS CloudFormation
• Infrastructure as a code
• JSON or YAML
• CloudFormation
•
•
• CloudFormation StackSets
CloudFormation

66. A
3
3 2 2
3 2
B F C
3
3 32
B F C
E

67. •
Ø
Ø
•
AWS CloudFormation - StackSets
Stack Set
Administrator Account
Target
Account A
Target
Account A
Target
Account B
Target
Account B
Stack Stack Stack
Account C Account E … Account C Account E …
Region Region
Account D
Account D
Stack Set
Create
Update
Delete
Stack Stack Stack Stack
Stack Stack Stack Stack
Stack Stack Stack Stack
Preferences
Tags
Stack

68. Serverless Application Model(AWS SAM)
•
• CloudFormation
• SAM
• CloudFormtion
https://docs.aws.amazon.com/ja_jp/lambda/latest/dg/serverless_app.html

69. AD
APN : AWS Partner Network
(https://aws.amazon.com/jp/partners/)

70. ESP Online
https://esp-online.com/

72. • AWS
•
• 1
•
•

73. Thank you!